Refitter: Code injection via OpenAPI content-type keys in generated Refit clients
Summary
Refitter, a tool that generates C# REST API clients for the Refit library from OpenAPI descriptions, does not escape content-type keys from the specification. A crafted content-type key in an attacker-influenced OpenAPI description breaks out of the generated attribute string and can add a top-level C# class with a ModuleInitializer method. This code runs when the generated assembly is loaded at application startup, even if the client is never called. The attack requires that a developer or pipeline generates code from the malicious specification and that a user interacts with the process.
Affected
- Refitter versions before 2.1.2
- Refitter.MSBuild: update to the matching version as well
Fixed in
- Refitter 2.1.2 (released 29 July 2026, per the project changelog)
- Later releases were not verified; use the latest stable release after checking it
Workaround
Unknown.
Exploitation
- No known exploitation in the wild; no CISA KEV entry found at the time of research.
- A public proof of concept has not been confirmed.
- EPSS: 0.35 % (percentile 29).
Our recommendation
- Upgrade Refitter and Refitter.MSBuild to 2.1.2 or later.
- Generate clients only from specifications you control or have reviewed; treat third-party and partner specifications as untrusted.
- Review generated .cs files for unexpected top-level classes or ModuleInitializer attributes before compiling.
- Run code generation in CI without access to secrets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Refitter 2.1.2 release github.com
- GitHub security advisory GHSA-p32v-8v8j-j534 github.com
- Fix commit ab4d8e4 github.com
- Pull request #1178 github.com
- Refitter changelog github.com
- VulDB entry CVE-2026-63344 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:42.
Original description (NVD)
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
NVD references (7)
- https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67
- https://github.com/christianhelle/refitter/pull/1178
- https://github.com/christianhelle/refitter/releases/tag/2.1.2
- https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534
- https://github.com/user-attachments/files/29394848/reproduce.sh
- https://github.com/user-attachments/files/29394851/maintainer-report.txt
- https://github.com/user-attachments/files/29394853/make_spec.py
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.