Live › vulnerability › CVE-2026-63345
Refitter, a tool that generates C# REST clients from OpenAPI specs, writes path keys into generated code without escaping quotes. A crafted path can inject a ModuleInitializer that runs attacker code when the generated assembly loads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams that run Refitter to generate C# Refit clients from OpenAPI specs, especially specs from outside sources. The generated code must be compiled and loaded for the payload to run, so teams that only use hand-written clients or a fixed, trusted spec are not exposed. Versions before 2.1.2 are affected; the report says the default validation does not block the crafted path.
No product ranges from the sources yet.
refitter --version or the version pinned in the project's tool manifest.2.1.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as [Get("<path>")] without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without --skip-validation and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A [ModuleInitializer] method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-63345")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.