Refitter: C# code injection via OpenAPI path keys in generated Refit clients
Summary
Refitter, a tool that generates C# REST API clients for the Refit library, emitted OpenAPI path keys into Refit route attributes without proper escaping. A crafted single-line path in an OpenAPI specification can break out of the attribute string and inject a top-level C# class with a [ModuleInitializer] method. The injected code runs when an application compiles and loads the generated assembly at startup, even if the generated client is never called. Default validation does not block the payload.
Affected
- Refitter versions prior to 2.1.2
- Refitter.MSBuild: affected versions as documented by the vendor (unknown exact range)
Fixed in
- Refitter 2.1.2 and later (fix in commit 793d263, PR #1178)
Workaround
Unknown. No workaround is documented by the vendor; upgrading to a fixed version is required.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed; no CISA KEV listing found.
- The CVE record links public reproducer files; their status is unverified.
Our recommendation
- Upgrade Refitter and Refitter.MSBuild to 2.1.2 or later, preferably the latest stable release.
- Regenerate and redeploy all clients generated by an affected version.
- Check generated code for unexpected path strings or unusual top-level declarations, especially in clients built from external specs.
- Only generate clients from trusted OpenAPI specifications and review changes to path keys in pull requests.
- If an affected version processed untrusted specs on a build server, review that server's exposure and rotate its secrets as a precaution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-3fhm-p725-h3g3 github.com
- Refitter release 2.1.2 github.com
- Fix commit 793d263 github.com
- Pull request #1178 github.com
- Refitter CHANGELOG github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:43.
Original description (NVD)
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
NVD references (7)
- https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973
- https://github.com/christianhelle/refitter/pull/1178
- https://github.com/christianhelle/refitter/releases/tag/2.1.2
- https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3
- https://github.com/user-attachments/files/29395228/maintainer-report.txt
- https://github.com/user-attachments/files/29395229/make_spec.py
- https://github.com/user-attachments/files/29395230/reproduce.sh
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.