CVE-2026-63344: Refitter: C# source injection through OpenAPI content-type map keys

Published Oct 30, 2026

Updated

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit [Headers("Accept: <ct>", "Content-Type: <ct>")] attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without --skip-validation, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A [ModuleInitializer] method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

Event History

Oct 30, 2026

CVE Published

via MITRE·10:15 PM

Data Sourced

via MITRE·10:15 PM

DescriptionWeakness

Data Sourced

via OSV·10:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Teams that generate C# REST API clients with affected Refitter versions from attacker-influenced OpenAPI descriptions are exposed. The issue was verified with Refitter 2.0.0 and .NET 8, and is fixed in Refitter 2.1.2.

What does an attacker need to exploit it?

An attacker needs influence over content-type keys in the requestBody or responses content maps of an OpenAPI description processed by Refitter. They can use quotation marks in a crafted key to escape the generated Refit attribute string and inject valid C# source.

Does default OpenAPI validation prevent exploitation?

No. The crafted content-type key can survive Refitter's default validation, so exploitation does not require use of the --skip-validation option.

When would injected code run?

Injected code can be placed in a top-level class with a ModuleInitializer method. It executes when the generated assembly is loaded at application startup, without requiring any call to the generated client.

What should be done if patching is not immediately possible?

Do not generate clients from untrusted or attacker-influenced OpenAPI descriptions, and review content-type keys under requestBody and responses content maps before generation. Upgrade to Refitter 2.1.2 when possible.

CVE-2026-63344: Refitter: C# source injection through OpenAPI content-type map keys

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does default OpenAPI validation prevent exploitation?

When would injected code run?

What should be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Does default OpenAPI validation prevent exploitation?

When would injected code run?

What should be done if patching is not immediately possible?