CVE-2026-63346 in Refitter
Summary
by MITRE • 10/31/2026
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified as a code injection flaw within the Refitter tool, specifically affecting versions prior to 2.1.2, represents a critical security risk for developers utilizing automated API client generation workflows. Refitter serves as an essential utility that translates OpenAPI specifications into C# REST API clients using the Refit library. The core technical deficiency lies in the handling of header parameters defined within the input specification. When processing an OpenAPI description where a parameter is designated with `in: header`, the tool extracts the value from the `parameters[].name` field and embeds it directly into a C# attribute string, specifically `[Header("<name>")]`. Crucially, this process fails to escape quotation marks or other special characters that could alter the syntactic structure of the generated code. This lack of sanitization allows an attacker who controls the OpenAPI description to inject arbitrary C# syntax by closing existing parameter lists and method definitions, effectively breaking out of the intended scope of the attribute generation logic.
The operational impact of this vulnerability is severe because it enables remote code execution under specific conditions that do not require user interaction with the generated client itself. By carefully crafting an OpenAPI specification, a malicious actor can cause Refitter to generate valid C# source files that contain top-level classes equipped with `[ModuleInitializer]` attributes. In modern .NET environments, particularly those running on .NET 8 as verified in this context, methods marked with `ModuleInitializer` are executed automatically when the assembly is loaded into memory at application startup. This means that if a developer integrates the generated client library into their project and builds it, or even just loads the resulting DLL for inspection or dependency resolution, the injected malicious code will execute immediately upon loading. The attack vector bypasses standard validation mechanisms because the input OpenAPI description can be structured to pass default schema checks without requiring the `--skip-validation` flag, making this a plausible threat in automated CI/CD pipelines where such tools are frequently employed.
This flaw is categorized under CWE-94 as Improper Control of Generation of Code (Code Injection), specifically highlighting the failure to neutralize special elements that could modify command or code structure. From an offensive security perspective, it aligns with ATT&CK techniques related to Supply Chain Compromise and potentially T1059 Command and Scripting Interpreter if viewed through the lens of executing injected scripts via compiled binaries. The vulnerability exploits the trust developers place in generated artifacts, assuming that tool output is syntactically safe even when derived from external or semi-trusted sources like third-party API definitions. While other sinks such as `AliasAs` attributes and enum default values are properly escaped within Refitter, this specific oversight in header name emission creates a distinct attack surface that compromises the integrity of the entire build process for any application depending on the generated client library.
Mitigation strategies must prioritize immediate updates to mitigate exposure until patching is feasible. The most effective remediation is upgrading Refitter to version 2.1.2 or later, where this code injection flaw has been addressed by implementing proper escaping mechanisms for header parameter names within attribute strings. For organizations unable to update immediately due to dependency constraints, it is critical to enforce strict validation of all OpenAPI specifications used in automated generation pipelines. This includes treating any external API definitions as untrusted input and applying rigorous schema validation that rejects non-standard or potentially malicious structures before they reach the code generator. Additionally, developers should avoid using generated client libraries from unknown sources in production environments without thorough manual review of the resulting source code to detect any anomalous top-level classes or initializer methods. Implementing static analysis tools configured to flag unexpected `ModuleInitializer` attributes can also provide an additional layer of defense against such supply chain attacks.