Refitter CVE-2026-63345

Requires the victim to generate a Refit client with Refitter <= 2.0.0 from an attacker-controlled or attacker-influenced OpenAPI document whose paths-object key is a crafted single-line, slash-prefixed string containing quote/structure-breaking characters, and then compile the generated .cs into an application. The payload survives Refitter's default OpenAPI validation, so --skip-validation is NOT required. Code runs via a [ModuleInitializer] at assembly load/process startup even if the generated client is never invoked. Limiting factors: exploitation depends on a developer-driven codegen-plus-compile workflow against an untrusted spec (UI:A); it does not affect already-built applications unless they are regenerated and recompiled from a malicious spec; the enum and default-value sinks are escaped and are not exploitable - only the path-emission (and raw [Header] name) sinks are. Upgrading to 2.1.2 (which escapes the route template and adds AttributeStringValidator) is the fix.

Signals are moderate-to-serious but conditional. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:A, VC/VI/VA:H, score 8.6) describes full code execution with no authentication, but UI:A is doing heavy lifting: exploitation is not a direct network strike on a running service - it requires a developer to run Refitter codegen against an attacker-controlled/influenced OpenAPI spec and compile the output. No EPSS score and no KEV status were provided in the input, so there is no confirmed active-exploitation or probability signal; exploitation status is best described as a public PoC reference existing (reproduce.sh/make_spec.py attached to the advisory), not confirmed in-the-wild use. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a real but not fire-drill priority. CWE-94 code injection resulting in [ModuleInitializer] execution at assembly load is high-impact (runs even if the generated client is never called), which justifies treating it seriously for any team that generates Refit clients from untrusted or externally-sourced specs. Conflicting data to verify: the GHSA package-metadata line reads 'fixed in: not yet patched' while the CVE description, release tag 2.1.2, PR 1178, and commit 793d263 all indicate a fix shipped in 2.1.2 - treat 2.1.2 as the fixed version and verify the stale 'not yet patched' label with the vendor. Net: a genuine RCE but with a supply-chain-style precondition (untrusted OpenAPI input + compilation), so prioritize for CI/codegen pipelines ingesting external specs rather than as a broad internet-exposed emergency.

An attacker controls or influences an OpenAPI description that a .NET team imports (e.g., a hosted/third-party spec), embedding a crafted single-line, slash-prefixed path key that closes the [Get("...")] attribute and injects a top-level file class with a [ModuleInitializer] method. A developer generates a Refit client with Refitter <= 2.0.0 under default validation (no --skip-validation needed) and compiles it into an application; at assembly load the attacker's code runs even though Main never touches the generated client. Public reproduction scripts (reproduce.sh, make_spec.py) are attached to the advisory, demonstrating the marker written at startup.