{"affected":[{"product":"refitter","source":"CNA: GitHub_M","vendor":"christianhelle","versions":[{"status":"affected","version":"< 2.1.2"}]},{"ecosystem":"nuget","packageName":"Refitter","product":"Refitter","source":"GitHub GHSA-p32v-8v8j-j534","vendor":"","versions":[{"status":"affected","version":"<= 2.0.0","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-63344","cwes":["CWE-94","CWE-116"],"description":"Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of `requestBody/responses` are emitted verbatim into a Refit `[Headers(\"Accept: <ct>\", \"Content-Type: <ct>\")]` attribute string without escaping quotation marks. A crafted content-type key in an attacker-influenced OpenAPI description survives default validation without `--skip-validation`, breaks out of the attribute string and enclosing interface and namespace, and can introduce a top-level file class while leaving valid generated C#. A `[ModuleInitializer]` method in that class executes attacker code when the generated assembly is loaded at application startup, without requiring a call to the client. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.","epss":{"date":"2026-11-06","percentile":0.28834,"score":0.0035},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"}],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":8.6,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793990979123,"publishedAt":1793398527846,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/christianhelle/refitter/pull/1178"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/christianhelle/refitter/releases/tag/2.1.2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/user-attachments/files/29394848/reproduce.sh"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/user-attachments/files/29394851/maintainer-report.txt"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/user-attachments/files/29394853/make_spec.py"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/christianhelle/refitter/pull/1178"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/christianhelle/refitter/releases/tag/2.1.2"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/user-attachments/files/29394848/reproduce.sh"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/user-attachments/files/29394851/maintainer-report.txt"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/user-attachments/files/29394853/make_spec.py"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"}],"remediation":[],"revision":"8e7e2005cb18d25ad5d404f08b883a7e7dcd5fac838925102dcaed75f4c17299","sources":[{"modifiedAt":1793990979123,"name":"CNA: GitHub_M","retrievedAt":1793992341160,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63344"},{"modifiedAt":1793648133347,"name":"NVD","retrievedAt":1793665723931,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63344"},{"modifiedAt":1784228649000,"name":"GitHub Security Advisories","retrievedAt":1793753709511,"url":"https://github.com/christianhelle/refitter/security/advisories/GHSA-p32v-8v8j-j534"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793992359162,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63344"}],"ssvc":{"assessedAt":1793990956142,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Refitter: C# source injection through OpenAPI content-type map keys","updatedAt":1793992359162}