CVE-2026-63345High· 8.6▾ TwilightRefitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or re…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as [Get("<path>")] without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without --skip-validation and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A [ModuleInitializer] method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
refitter < 2.1.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63346High· 8.6Refitter: C# source injection through OpenAPI header parameter names
CVE-2026-63344High· 8.6Refitter: C# source injection through OpenAPI content-type map keys
CVE-2026-63184High· 7.1Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
CVE-2025-11905Medium· 6.3A vulnerability was found in yanyutao0402 ChanCMS up to 3.3.2
CVE-2025-10097Medium· 6.3A vulnerability was identified in SimStudioAI sim up to 1.0.0
CVE-2025-13786High· 7.3A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665