Header Injection Vulnerability in Refitter Tool by Christian Helle

CVE-2026-63346

What is CVE-2026-63346?

The Refitter tool, which generates C# REST API clients, contains a vulnerability that allows attackers to inject malicious header names into generated attributes. This occurs due to the emission of header parameter names without escaping quotation marks, particularly in the parameters[].name field with in: header. If an attacker controls the OpenAPI description, default validation mechanisms can be bypassed, leading to arbitrary code execution when the compiled assembly is loaded at application startup. The flaw has been resolved in version 2.1.2.

References