CVE-2026-63346: Refitter: C# source injection through OpenAPI header parameter names

Published Oct 30, 2026

Updated

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in parameters[].name with in: header is emitted verbatim into a Refit [Header("<name>")] attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without --skip-validation and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a [ModuleInitializer] method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query AliasAs and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

Event History

Oct 30, 2026

CVE Published

via MITRE·10:17 PM

Data Sourced

via MITRE·10:17 PM

DescriptionWeakness

Data Sourced

via OSV·10:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Organizations using Refitter versions before 2.1.2 to generate C# clients from attacker-influenced or untrusted OpenAPI descriptions are exposed. The affected input is a header parameter name in parameters[].name where in is set to header.

Does an attacker need to bypass OpenAPI validation or require the generated client to be called?

No. The malicious OpenAPI description can pass default validation without using --skip-validation, and the generated client does not need to be called. Injected code can execute when the compiled assembly is loaded at application startup through a ModuleInitializer method.

What is the remediation?

Upgrade Refitter to version 2.1.2, which fixes the header-name attribute-string escaping issue. Until upgrading, do not generate clients from untrusted OpenAPI descriptions and review header parameter names before generation for quotation marks or other unexpected content.

How can teams identify whether generated code may be affected?

Review OpenAPI inputs processed by vulnerable Refitter versions for header parameters whose names contain quotation marks, then inspect generated C# files for unexpected top-level classes or methods marked with ModuleInitializer. The relevant sink is Refit [Header("<name>")] attribute generation; query AliasAs and enum/default-value handling are described as escaped.

CVE-2026-63346: Refitter: C# source injection through OpenAPI header parameter names

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does an attacker need to bypass OpenAPI validation or require the generated client to be called?

What is the remediation?

How can teams identify whether generated code may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does an attacker need to bypass OpenAPI validation or require the generated client to be called?

What is the remediation?

How can teams identify whether generated code may be affected?