Arbitrary File Disclosure Vulnerability in Refitter Tool by Christian Helle

CVE-2026-63184

What is CVE-2026-63184?

The Refitter tool, which is designed for generating C# REST API clients, was found to have a vulnerability before version 2.1.1. This issue arises when the refitter dotnet tool interacts with NJsonSchema using insecure defaults for $ref resolution. When processing untrusted OpenAPI descriptions, it can lead to remote HTTP(s) references that invoke requests from the developer's environment or CI host. Additionally, the vulnerability allows for the inline inclusion of untrusted remote schema content into the generated output. This compromises file security by permitting arbitrary local-file disclosure through absolute and relative path resolutions, effectively exposing sensitive files within the input directory. Although this vulnerability's potential effects include server-side request forgery and local file inclusion, it does not extend to code execution. Updating to version 2.1.1 remedies this concern.

References