Remote Code Execution Vulnerability in Refitter C# REST API Client by Christian Helle

CVE-2026-63345

What is CVE-2026-63345?

The vulnerability in Refitter prior to version 2.1.2 allows attackers to execute arbitrary code by exploiting unescaped path attributes in generated C# REST API clients. An attacker can craft a malicious single-line, slash-prefixed path that bypasses default validation. This manipulated path can close off attribute strings while introducing unintended classes and methods during the compilation of the generated assembly. Notably, this occurs without the need for the application to explicitly call the generated client. The vulnerability was confirmed in Refitter 2.0.0 on .NET 8 and has been addressed in version 2.1.2.

References