Security Flaw in Refitter API Client Tool by Christian Helle

CVE-2026-63344

What is CVE-2026-63344?

The Refitter tool, used for generating C# REST API clients, has a vulnerability that allows unvalidated content-type keys in requestBody/responses to be emitted directly into Refit's header attributes, which could lead to code injection. This vulnerability permits an attacker to manipulate an OpenAPI description, allowing crafted keys to break out of their intended context. When the generated assembly is loaded during application startup, a method in a newly created file class can execute malicious code without requiring direct calls. This issue has been addressed in version 2.1.2.

References