Refitter: Code injection via header parameter names in generated Refit clients
Summary
Refitter generates C# REST API clients from OpenAPI descriptions. Before version 2.1.2, header parameter names from the description were written into generated code without escaping quotation marks. A crafted OpenAPI description can inject C# code that runs when the compiled assembly loads at application startup, even if the client is never called. Default validation does not block this input, and the flaw is limited to header names.
Affected
- Refitter versions before 2.1.2
Fixed in
- Refitter 2.1.2
Workaround
- Unknown.
- Do not generate clients from OpenAPI descriptions you do not control.
- Do not use --skip-validation, because it disables the attribute string validator.
Exploitation
- In the wild: unknown.
- Public proof-of-concept: attachments are referenced in the NVD references but were not verified.
- VulDB lists the status as 0-Day; this label was not verified.
Our recommendation
- Upgrade Refitter to 2.1.2 or newer.
- Only generate clients from OpenAPI descriptions you trust.
- Review generated .cs files for unexpected ModuleInitializer code before building.
- Run code generation in isolated CI jobs without access to secrets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 63a19b0 (refitter) github.com
- Pull Request #1178 (refitter) github.com
- Refitter release 2.1.2 github.com
- GHSA-58x9-vjvp-6mx8 security advisory github.com
- VulDB entry 429437 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:41.
Original description (NVD)
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
NVD references (7)
- https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1
- https://github.com/christianhelle/refitter/pull/1178
- https://github.com/christianhelle/refitter/releases/tag/2.1.2
- https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8
- https://github.com/user-attachments/files/29395048/maintainer-report.txt
- https://github.com/user-attachments/files/29395050/make_spec.py
- https://github.com/user-attachments/files/29395051/reproduce.sh
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.