CVE-2026-63184High· 7.1▾ MidnightPoC availableRefitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts fr…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the refitter dotnet tool invokes NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative ../ traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
refitter < 2.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63346High· 8.6Refitter: C# source injection through OpenAPI header parameter names
CVE-2026-63345High· 8.6Refitter: C# source injection through OpenAPI path keys
CVE-2026-63344High· 8.6Refitter: C# source injection through OpenAPI content-type map keys
CVE-2026-12171High· 7.8auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source
CVE-2026-54918Medium· 5.3NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox
CVE-2021-21985Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server