CVE-2026-63346

Received Received - Intake

Refitter Header Parameter Injection Vulnerability Before 2.1.2

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63346

Affected Vendors & Products

Vendor	Product	Version / Range
christianhelle	refitter	< 2.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

Refitter is a tool that generates a C# REST API client using the Refit library. Prior to version 2.1.2, it had a flaw where header parameter names in OpenAPI descriptions were not properly escaped when generating C# code. This allowed attackers to inject malicious code into the generated client by manipulating the OpenAPI description. The injected code could execute when the assembly is loaded, even if the client is never used.

Detection Guidance

Check Refitter version with 'refitter --version' or inspect generated C# files for header parameters with unescaped quotes. Look for files containing '[Header("' followed by user-controlled input.

Impact Analysis

If you use a vulnerable version of Refitter (before 2.1.2) to generate a C# REST API client, an attacker could craft a malicious OpenAPI description that injects harmful code into the generated client. This code could execute automatically when your application starts, potentially leading to unauthorized access, data breaches, or other malicious activities without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized code execution, which may result in data breaches or unauthorized access to sensitive information. Such incidents could violate compliance requirements under GDPR, HIPAA, or other regulations, potentially leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Refitter to version 2.1.2 or later. If using older versions, avoid generating clients from untrusted OpenAPI specs or add manual validation of header parameter names.

Hi! I’m here to help you understand CVE-2026-63346. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70