CVE-2026-63345

Received Received - Intake

Refitter Path Injection Leading to Arbitrary Code Execution

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63345

Affected Vendors & Products

Vendor	Product	Version / Range
christianhelle	refitter	< 2.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1116	The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.

Attack-Flow Graph

Executive Summary

Refitter before 2.1.2 emits OpenAPI path keys directly into C# route attributes without proper escaping. An attacker can craft a path that closes the attribute string, interface, and namespace, then inject a top-level class that executes via a ModuleInitializer when the assembly loads at startup.

Detection Guidance

This vulnerability is specific to Refitter versions prior to 2.1.2 and involves malicious OpenAPI paths generating unsafe C# code. Detection requires checking Refitter versions in use and reviewing generated client code for unusual paths or attributes. No direct network detection commands exist; inspect build outputs and dependencies.

Impact Analysis

An attacker could execute arbitrary code on your system when your application compiles and loads the generated Refitter assembly, even without calling the client. This could lead to full system compromise depending on the privileges of the running application.

Mitigation Strategies

Upgrade Refitter to version 2.1.2 or later immediately. If using an affected version, regenerate client code with the latest version and validate all OpenAPI paths for proper escaping. Remove any untrusted or suspicious OpenAPI specifications before processing.

Hi! I’m here to help you understand CVE-2026-63345. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70