---
id: CVE-2026-63346
title: 'Refitter: C# source injection through OpenAPI header parameter names'
summary: >-
  Refitter is a tool for generating a C# REST API client using the Refit
  library. Prior to 2.1.2, the header parameter name in `parameters[].name` with
  `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute
  string wit…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-94
  - CWE-116
vendor: christianhelle
product: refitter
affected:
  - refitter < 2.1.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T14:46:50.420778Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:47:20.841Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63346'
references:
  - url: >-
      https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8
    label: >-
      https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8
  - url: 'https://github.com/christianhelle/refitter/pull/1178'
    label: 'https://github.com/christianhelle/refitter/pull/1178'
  - url: >-
      https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1
    label: >-
      https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1
  - url: 'https://github.com/christianhelle/refitter/releases/tag/2.1.2'
    label: 'https://github.com/christianhelle/refitter/releases/tag/2.1.2'
  - url: 'https://github.com/user-attachments/files/29395048/maintainer-report.txt'
    label: 'https://github.com/user-attachments/files/29395048/maintainer-report.txt'
  - url: 'https://github.com/user-attachments/files/29395050/make_spec.py'
    label: 'https://github.com/user-attachments/files/29395050/make_spec.py'
  - url: 'https://github.com/user-attachments/files/29395051/reproduce.sh'
    label: 'https://github.com/user-attachments/files/29395051/reproduce.sh'
tags:
  - cve.org
  - exploit-available
epss: 0.0035
epssPercentile: 0.28833
ingestedAt: '2026-11-05T19:30:42.671Z'
---

## Overview

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

## Affected

- `refitter < 2.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.