---
id: "CVE-2026-63344"
kind: "vulnerability"
aliases: ["CVE-2026-63344"]
title: "Refitter: crafted OpenAPI content-type key injects code into generated C# client"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["csharp", "dotnet", "openapi", "package", "refit", "refitter"]
not_affected_if: ["hand-written-clients", "trusted-openapi-only"]
published_at: "2026-10-30T23:17:13+00:00"
first_seen_at: "2026-10-30T23:26:12+00:00"
updated_at: "2026-10-30T23:28:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63344", "first_seen_at": "2026-10-30T23:26:12+00:00"}]
---

# Refitter: crafted OpenAPI content-type key injects code into generated C# client

Refitter is a tool that generates C# REST clients from OpenAPI files. A crafted content-type key in an OpenAPI description breaks out of generated code and adds a module initializer that runs attacker code when the generated assembly loads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Refitter version with `refitter --version` or the package reference in the project file.
- Look for Refitter use in build or code generation steps that read OpenAPI descriptions from untrusted or third-party sources.

## Fix

- Refitter: move to `2.1.2` or later.

## Timeline

- 2026-10-30T23:26:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63344

## From the sources

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_