Live › vulnerability › CVE-2026-63184
Refitter is a .NET tool that generates C# Refit API clients from OpenAPI files. Before 2.1.1 it resolves attacker-influenced $ref links, so a crafted spec can make the generating machine fetch remote URLs or read local files and copy their contents into the generated code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Teams that run the refitter dotnet tool on OpenAPI descriptions that come from outside their control, such as third-party specs or user-supplied files, on a developer machine or CI host. Teams that only generate clients from their own reviewed specs in a controlled pipeline are less exposed. The sources say the chain stops at SSRF, remote file inclusion and local file inclusion, not code execution.
No product ranges from the sources yet.
refitter dotnet tool, for example with dotnet tool listrefitter in CI pipelines and developer scripts that generate clients from OpenAPI descriptions you do not fully controlrefitter version or later, per the source2.1.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the refitter dotnet tool invokes NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative ../ traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-63184")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.