CVE-2026-63184 in Refitter
Summary
by MITRE • 10/31/2026
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in versions of the Refitter tool prior to 2.1.1 stems from unsafe handling of external references within OpenAPI specification documents during code generation. Refitter serves as a utility for generating C# REST API clients using the Refit library, and its core function involves parsing OpenAPI descriptions to produce interface definitions and data contracts. The fundamental flaw lies in how the tool invokes NJsonSchema with default configurations that do not adequately restrict or validate remote resource resolution. When an attacker controls or influences the input OpenAPI description, they can exploit this lack of validation to force the generation process into making unintended network requests or accessing local file systems. This behavior transforms a code-generation utility into a vector for server-side attacks and information disclosure, as the tool acts on behalf of the developer or continuous integration host without sufficient security boundaries.
The operational impact manifests primarily through two distinct attack vectors: remote resource inclusion and local file traversal. First, when the OpenAPI specification contains absolute http or https references in $ref fields, Refitter automatically resolves these URLs by issuing requests from the machine executing the tool. This behavior effectively turns the developer workstation or CI server into a proxy for arbitrary outbound traffic, facilitating Server-Side Request Forgery attacks. An attacker can craft an OpenAPI document that points to internal network services, such as cloud metadata endpoints or private API gateways, causing the generation process to leak sensitive responses back through the generated code output if those responses are embedded inline. Second, the tool fails to properly sanitize relative paths containing directory traversal sequences like ../. This allows references to escape the intended input directory and access arbitrary files on the local file system. By inlining the content of these external or local resources directly into the generated C# source code, an attacker can achieve Local File Inclusion, potentially exposing configuration files, environment variables, or other sensitive data stored on the host machine.
Despite the severity of information disclosure and SSRF capabilities, this vulnerability chain does not lead to remote code execution in the context of running the generated application. The security model of Refit mitigates direct exploitation for command injection because the base URL is set at runtime rather than being hardcoded or parsed from untrusted input during execution. Furthermore, string defaults within the generated enums and contracts are handled using verbatim-string doubling mechanisms that prevent standard escape sequence interpretation, and other string literals are properly escaped. This means that while an attacker can force the inclusion of malicious content into the source code, they cannot easily inject executable logic or bypass runtime security controls to achieve arbitrary code execution on the target system. The risk is therefore confined to confidentiality breaches via local file disclosure and network reconnaissance via SSRF during the development or CI pipeline phase.
To mitigate this vulnerability, organizations must immediately upgrade Refitter to version 2.1.1 or later, where these unsafe defaults have been corrected. In environments where upgrading is not immediately feasible, developers should treat all OpenAPI specifications as untrusted input and avoid running generation tools against documents sourced from external parties without rigorous validation. Implementing network egress filtering for CI hosts can help mitigate the SSRF aspect by blocking outbound requests to unauthorized or internal IP ranges. Additionally, restricting file system access permissions for the user account executing the build process can limit the scope of local file disclosure attacks. This issue is categorized under CWE-918 for Server-Side Request Forgery and CWE-22 for Improper Limitation of a Pathname to a Restricted Directory, reflecting its dual nature as both a network-based attack vector and a path traversal flaw within automated tooling workflows.