refitter vulnerabilities
CVEs whose affected-version data names the refitter package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-63345High· 8.6Refitter: C# source injection through OpenAPI path keys
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or re…
CVE-2026-63346High· 8.6PoCRefitter: C# source injection through OpenAPI header parameter names
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string wit…
CVE-2026-63184High· 7.1PoCRefitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts fr…
CVE-2026-63344High· 8.6Refitter: C# source injection through OpenAPI content-type map keys
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <…