Refitter CVE-2026-63346

Exploitation requires a victim to run Refitter version 2.0.0 or earlier to generate a Refit client from an attacker-controlled or attacker-influenced OpenAPI description, and then compile that generated code into an application. The specific trigger is an OpenAPI header parameter (parameters[].name with in: header, or an ApiKey security scheme with in: header) whose name contains a double-quote character, which breaks out of the generated [Header("<name>")] Refit attribute, closes the parameter list/method/interface/namespace, and injects a top-level file class with a [ModuleInitializer] method that .NET runs at assembly load. Crucially, no --skip-validation is required - the malicious name passes Refitter's default OpenAPI validation. Limiting factors that reduce real-world risk: the attack needs the developer to ingest an untrusted spec and perform a build/compile step (UI:A), and only the header-name attribute sink is vulnerable - query AliasAs and enum/default value sinks are already escaped. Fixed in 2.1.2, which escapes spec-derived strings and adds AttributeStringValidator to reject unsafe characters unless validation is skipped.

This is a genuine code-execution flaw (CWE-94/CWE-116) but its real-world risk is gated by a developer-in-the-loop precondition rather than being a drive-by remote exploit. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.6: network-reachable, low complexity, no privileges, but requiring active user interaction - consistent with the mechanism, since a victim developer must generate a Refit client from an attacker-influenced OpenAPI description and compile it. KEV status is not present in the input, so there is no confirmed active exploitation; the vuln.today Decision label is 'this_week' (not act_now/emergency), indicating prompt-but-not-crisis prioritization. No EPSS score is provided, so probabilistic exploitation likelihood cannot be weighed. A public PoC reference exists (reproduce.sh + make_spec.py attached to the advisory), but it is not verified as working exploit code; PoC availability is a distinct signal from active exploitation and should not be read as 'in the wild.' The notable escalators are that the payload survives Refitter's DEFAULT validation (no --skip-validation needed) and that [ModuleInitializer] executes at assembly load even if the generated client is never called - so impact is high once the preconditions are met. Net: a real priority for anyone who generates Refit clients from untrusted specs, but mitigated in practice by the niche footprint and the need for a build/compile step.

An attacker publishes or influences an OpenAPI description whose header parameter (in: header) carries a name containing a double-quote that closes the [Header("...")] attribute and injects a top-level file class with a [ModuleInitializer] method. A developer runs Refitter (<= 2.0.0) against that spec under default validation, generates the client, and compiles it into their application; the injected code then runs at assembly load during application startup even though Main never calls the client. A public PoC reference (reproduce.sh/make_spec.py) demonstrates this chain, though it is not verified as a packaged working exploit.