CVE-2026-63345

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.

• CWE-94
• CWE-1116

• https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973
• https://github.com/christianhelle/refitter/pull/1178
• https://github.com/christianhelle/refitter/releases/tag/2.1.2
• https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3
• https://github.com/user-attachments/files/29395228/maintainer-report.txt
• https://github.com/user-attachments/files/29395229/make_spec.py
• https://github.com/user-attachments/files/29395230/reproduce.sh

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63339IXP Manager is a full-stack web application for managing Int…8.8
• CVE-2026-6334Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…3.8
• CVE-2026-63341Aedes is an MQTT broker that can run on any stream server. P…7.5
• CVE-2026-63342Hatchet is a platform for orchestrating background tasks, AI…6.3
• CVE-2026-63343Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-63344Refitter is a tool for generating a C# REST API client using…8.6
• CVE-2026-63346Refitter is a tool for generating a C# REST API client using…8.6
• CVE-2026-63349AnyIO is a high level asynchronous concurrency and networkin…7
• CVE-2026-6335GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-63350Affected devices do not properly restrict executable content…9.6
• CVE-2026-63351Affected devices do not properly validate and sanitize visua…6.1
• CVE-2026-63352Affected devices do not properly sanitize calculated signal …6.1