---
id: CVE-2026-63344
title: 'Refitter: C# source injection through OpenAPI content-type map keys'
summary: >-
  Refitter is a tool for generating a C# REST API client using the Refit
  library. Prior to 2.1.2, content-type keys in the content maps of
  `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept:
  <ct>", "Content-Type: <…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-94
  - CWE-116
vendor: christianhelle
product: refitter
affected:
  - refitter < 2.1.2
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T22:15:27.846Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63344'
references:
  - url: >-
      https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534
    label: >-
      https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534
  - url: 'https://github.com/christianhelle/refitter/pull/1178'
    label: 'https://github.com/christianhelle/refitter/pull/1178'
  - url: >-
      https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67
    label: >-
      https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67
  - url: 'https://github.com/christianhelle/refitter/releases/tag/2.1.2'
    label: 'https://github.com/christianhelle/refitter/releases/tag/2.1.2'
  - url: 'https://github.com/user-attachments/files/29394848/reproduce.sh'
    label: 'https://github.com/user-attachments/files/29394848/reproduce.sh'
  - url: 'https://github.com/user-attachments/files/29394851/maintainer-report.txt'
    label: 'https://github.com/user-attachments/files/29394851/maintainer-report.txt'
  - url: 'https://github.com/user-attachments/files/29394853/make_spec.py'
    label: 'https://github.com/user-attachments/files/29394853/make_spec.py'
tags:
  - cve.org
epss: 0.0035
epssPercentile: 0.28833
ingestedAt: '2026-11-05T16:24:31.479Z'
---

## Overview

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

## Affected

- `refitter < 2.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.