Refitter EUVD-2026-114521

Exploitation requires that a developer or CI host run the refitter dotnet tool (version <= 2.0.0, before the 2.1.1 fix) against an OpenAPI description the attacker controls or can influence, where that spec contains a crafted $ref - either a remote http(s) URL (triggering SSRF and remote file inclusion) or an absolute local path / '../' traversal escaping the input directory (triggering out-of-tree local file inclusion). The root enabling condition is NJsonSchema's unsafe default $ref resolution shipped by refitter prior to 2.1.1; after the fix, remote $ref resolution is off by default (opt-in via --allow-remote-refs / allowRemoteReferences) and local refs are confined to the input directory. Limiting factors: exploitation is passive-user-interaction dependent (someone must actually invoke generation on the malicious spec), no authentication or privileges on the target are needed, the impact is file/SSRF disclosure rather than code execution (Refitter sets base URL at runtime, verbatim-doubles enum values, and escapes string defaults, so no RCE), and only versions at or below 2.0.0 with the vulnerable default are affected.

CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - network-reachable, low complexity, no privileges, but requiring user interaction, which is the key tempering signal: a developer or CI job must actually run refitter against an attacker-controlled or attacker-influenced OpenAPI spec. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious but non-emergency build-time issue. This is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the input. A public PoC reference exists (reproduce.sh, make_spec.py, listener.py attached to the advisory, verified on 2.0.0); it is not verified in the input as packaged working exploit code. The realistic impact is generation-time SSRF (CWE-918) from the developer/CI host, arbitrary local-file disclosure (CWE-22/LFI), and inclusion of untrusted remote content (CWE-829/RFI) - notably dangerous in CI where internal metadata endpoints and secret files are reachable. The advisory explicitly rules out code execution, so the 'RCE' tag overstates impact. Net: a genuine supply-chain/build-time priority for teams that run refitter on untrusted specs, but it is a targeted (attacker must get a malicious spec processed), not wormable or mass-exploitable, issue - patch to 2.1.1 rather than treat as a drop-everything emergency.

An attacker publishes or submits an OpenAPI description (e.g., a vendor spec, a PR to a repo, or a shared API doc) containing a malicious $ref such as http://169.254.169.254/... or ../../../etc/secret.json. When a developer or CI pipeline runs refitter on that spec to generate the Refit client, the NJsonSchema resolver fetches the internal URL (SSRF) or reads the out-of-tree local file and inlines its contents into the generated C

output, disclosing internal service responses or local secrets. A working PoC reference (reproduce.sh/listener.py) demonstrating SSRF, RFI, and LFI on version 2.0.0 is attached to the advisory.