---
id: "CVE-2026-63345"
kind: "vulnerability"
aliases: ["CVE-2026-63345"]
title: "Refitter: crafted OpenAPI paths let attacker code run at build"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["csharp", "dotnet", "openapi-codegen", "package", "refit", "refitter"]
not_affected_if: ["no-generated-refit-clients", "refitter-2.1.2-or-later", "trusted-openapi-specs-only"]
published_at: "2026-10-30T23:17:13+00:00"
first_seen_at: "2026-10-30T23:26:12+00:00"
updated_at: "2026-10-30T23:28:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63345", "first_seen_at": "2026-10-30T23:26:12+00:00"}]
---

# Refitter: crafted OpenAPI paths let attacker code run at build

Refitter, a tool that generates C# REST clients from OpenAPI specs, writes path keys into generated code without escaping quotes. A crafted path can inject a ModuleInitializer that runs attacker code when the generated assembly loads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Refitter version with `refitter --version` or the version pinned in the project's tool manifest.
- Look for generated Refit client files built from OpenAPI specs that you do not fully control.

## Fix

- Refitter: move to `2.1.2` or later.

## Timeline

- 2026-10-30T23:26:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63345

## From the sources

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_