CVE-2026-63184: Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the refitter dotnet tool invokes NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative ../ traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers and CI systems that run the refitter dotnet tool against attacker-controlled or attacker-influenced OpenAPI descriptions are exposed. The requests and local-file resolution occur from the host performing code generation.
What does an attacker need to exploit it?
An attacker needs to influence an OpenAPI description processed by Refitter before version 2.1.1, including its $ref values. They can use remote http(s) references or absolute and traversal-based local paths.
Can this lead to code execution on the build host?
The demonstrated impact is SSRF plus remote or local file inclusion into generated output, not code execution. The available analysis states that runtime base URL handling and escaping behavior prevent the demonstrated chain from reaching code execution.
What should be done if patching cannot happen immediately?
Do not run the tool on untrusted or attacker-influenced OpenAPI descriptions. In particular, prevent OpenAPI $ref values from reaching remote URLs, absolute local paths, or relative paths that traverse outside the input directory.
Which version fixes the issue?
The issue is fixed in Refitter version 2.1.1.