Live › vulnerability › CVE-2026-63346
Refitter, a tool that generates C# REST clients from OpenAPI files, fails to escape quotation marks in header parameter names, so a crafted OpenAPI description can inject code. The injected [ModuleInitializer] runs attacker code when the compiled assembly loads, even if the client is never called.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams that run Refitter to generate C# clients from OpenAPI descriptions, especially where the description can come from an untrusted source. The flaw is in header parameter names; query parameters and enum or default values are escaped. The issue was verified with Refitter 2.0.0 and .NET 8.
No product ranges from the sources yet.
refitter --version or the version in your project's tool manifest); versions before 2.1.2 are affected.[Header("...")] attributes contain unexpected quotation marks or a [ModuleInitializer] method in a top-level file class.2.1.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in parameters[].name with in: header is emitted verbatim into a Refit [Header("<name>")] attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without --skip-validation and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a [ModuleInitializer] method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query AliasAs and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-63346")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.