CVE-2026-63344

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers("Accept: <ct>", "Content-Type: <ct>")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.

• CWE-94
• CWE-116

• https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67
• https://github.com/christianhelle/refitter/pull/1178
• https://github.com/christianhelle/refitter/releases/tag/2.1.2
• https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534
• https://github.com/user-attachments/files/29394848/reproduce.sh
• https://github.com/user-attachments/files/29394851/maintainer-report.txt
• https://github.com/user-attachments/files/29394853/make_spec.py

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63338IXP Manager is a full-stack web application for managing Int…8.3
• CVE-2026-63339IXP Manager is a full-stack web application for managing Int…8.8
• CVE-2026-6334Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…3.8
• CVE-2026-63341Aedes is an MQTT broker that can run on any stream server. P…7.5
• CVE-2026-63342Hatchet is a platform for orchestrating background tasks, AI…6.3
• CVE-2026-63343Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-63345Refitter is a tool for generating a C# REST API client using…8.6
• CVE-2026-63346Refitter is a tool for generating a C# REST API client using…8.6
• CVE-2026-63349AnyIO is a high level asynchronous concurrency and networkin…7
• CVE-2026-6335GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-63350Affected devices do not properly restrict executable content…9.6
• CVE-2026-63351Affected devices do not properly validate and sanitize visua…6.1