Refitter
Monthly
Code execution at assembly load in Refitter-generated C# clients (CWE-94/CWE-116): a header parameter name taken from an OpenAPI description is emitted unescaped into a Refit [Header("...")] attribute, letting a crafted spec close the parameter list, method, interface and namespace and inject a top-level file class with a [ModuleInitializer] that .NET runs when the compiled assembly loads, even if the generated client is never called. Affected are Refitter releases prior to 2.1.2 (the behavior was reproduced on 2.0.0 with .NET 8), and exploitation requires a developer to generate and compile a client from an attacker-controlled or attacker-influenced OpenAPI description, which is why the assessed vector carries UI:R despite the 8.6 severity. The malicious header name survives Refitter's default OpenAPI validation (no --skip-validation needed), a public PoC reproduction harness (make_spec.py and reproduce.sh) is attached to GitHub advisory GHSA-58x9-vjvp-6mx8, and the supplied intelligence contains no CISA KEV entry for this issue.
Refitter, the .NET tool that generates C# Refit clients from OpenAPI descriptions, writes content-type keys from requestBody/responses content maps straight into Refit [Headers("Accept: <ct>", "Content-Type: <ct>")] attribute strings without escaping quotation marks, letting a crafted content-type key break out of the attribute, interface and namespace and inject a top-level file class whose [ModuleInitializer] method runs attacker code when the generated assembly loads. The hostile key survives Refitter's default OpenAPI validation, so --skip-validation is not required; behavior was verified on Refitter 2.0.0 with .NET 8, and all versions prior to 2.1.2 are in scope. Exploitation is not self-triggering: a developer must run Refitter on an attacker-influenced spec and compile the resulting client into an application (CVSS 4.0 UI:A / 3.1 UI:R), after which the injected code executes at process startup with no call to the generated client; there is no CISA KEV entry or confirmed active exploitation, and a public PoC reference (reproduce.sh, make_spec.py) is attached to the GitHub advisory but is not independently verified as working exploit code.
Code execution at assembly load in applications built from Refitter 2.0.0 and earlier: the generator copies each OpenAPI paths-object key verbatim into Refit route attributes such as [Get("...")] without escaping quotes or restricting characters, so a crafted single-line, slash-prefixed path can terminate the attribute string, the enclosing interface and namespace, inject a top-level file class carrying a [ModuleInitializer], and reopen the generated structure so the file still compiles. Anything that compiles the generated .cs into an application then runs the attacker's code at process startup, even if the generated client is never called. Exploitation requires the victim to generate and compile a client from an attacker-controlled or attacker-influenced spec (UI:R in the assessed vector, UI:A in the CVSS 4.0 vector); a public PoC reference (a reproduce script plus spec generator attached to the advisory) exists and is not verified as working exploit code. Fixed in 2.1.2; no confirmed active exploitation (CISA KEV) is reported.
Generation-time server-side request forgery, remote file inclusion and out-of-tree local file inclusion in the Refitter .NET tool (versions through 2.0.0) allow an attacker who controls or can influence an OpenAPI description to make the build host fetch arbitrary http(s) URLs or read files outside the input directory, with the retrieved content inlined into the generated C# Refit interfaces. Rated CVSS 3.1 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N: unauthenticated and low complexity on the network side, but exploitable only when a developer or CI job actually runs refitter against the malicious spec, and the chain terminates at disclosure and SSRF - no code execution, because Refit sets the base URL at runtime, enum values are verbatim-string doubled and string defaults are escaped. A public reproduction script is attached to the upstream advisory and was verified by the reporter against 2.0.0; no CISA KEV entry appears in the supplied data, and the vendor fix ships in 2.1.1.
Code execution at assembly load in Refitter-generated C# clients (CWE-94/CWE-116): a header parameter name taken from an OpenAPI description is emitted unescaped into a Refit [Header("...")] attribute, letting a crafted spec close the parameter list, method, interface and namespace and inject a top-level file class with a [ModuleInitializer] that .NET runs when the compiled assembly loads, even if the generated client is never called. Affected are Refitter releases prior to 2.1.2 (the behavior was reproduced on 2.0.0 with .NET 8), and exploitation requires a developer to generate and compile a client from an attacker-controlled or attacker-influenced OpenAPI description, which is why the assessed vector carries UI:R despite the 8.6 severity. The malicious header name survives Refitter's default OpenAPI validation (no --skip-validation needed), a public PoC reproduction harness (make_spec.py and reproduce.sh) is attached to GitHub advisory GHSA-58x9-vjvp-6mx8, and the supplied intelligence contains no CISA KEV entry for this issue.
Refitter, the .NET tool that generates C# Refit clients from OpenAPI descriptions, writes content-type keys from requestBody/responses content maps straight into Refit [Headers("Accept: <ct>", "Content-Type: <ct>")] attribute strings without escaping quotation marks, letting a crafted content-type key break out of the attribute, interface and namespace and inject a top-level file class whose [ModuleInitializer] method runs attacker code when the generated assembly loads. The hostile key survives Refitter's default OpenAPI validation, so --skip-validation is not required; behavior was verified on Refitter 2.0.0 with .NET 8, and all versions prior to 2.1.2 are in scope. Exploitation is not self-triggering: a developer must run Refitter on an attacker-influenced spec and compile the resulting client into an application (CVSS 4.0 UI:A / 3.1 UI:R), after which the injected code executes at process startup with no call to the generated client; there is no CISA KEV entry or confirmed active exploitation, and a public PoC reference (reproduce.sh, make_spec.py) is attached to the GitHub advisory but is not independently verified as working exploit code.
Code execution at assembly load in applications built from Refitter 2.0.0 and earlier: the generator copies each OpenAPI paths-object key verbatim into Refit route attributes such as [Get("...")] without escaping quotes or restricting characters, so a crafted single-line, slash-prefixed path can terminate the attribute string, the enclosing interface and namespace, inject a top-level file class carrying a [ModuleInitializer], and reopen the generated structure so the file still compiles. Anything that compiles the generated .cs into an application then runs the attacker's code at process startup, even if the generated client is never called. Exploitation requires the victim to generate and compile a client from an attacker-controlled or attacker-influenced spec (UI:R in the assessed vector, UI:A in the CVSS 4.0 vector); a public PoC reference (a reproduce script plus spec generator attached to the advisory) exists and is not verified as working exploit code. Fixed in 2.1.2; no confirmed active exploitation (CISA KEV) is reported.
Generation-time server-side request forgery, remote file inclusion and out-of-tree local file inclusion in the Refitter .NET tool (versions through 2.0.0) allow an attacker who controls or can influence an OpenAPI description to make the build host fetch arbitrary http(s) URLs or read files outside the input directory, with the retrieved content inlined into the generated C# Refit interfaces. Rated CVSS 3.1 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N: unauthenticated and low complexity on the network side, but exploitable only when a developer or CI job actually runs refitter against the malicious spec, and the chain terminates at disclosure and SSRF - no code execution, because Refit sets the base URL at runtime, enum values are verbatim-string doubled and string defaults are escaped. A public reproduction script is attached to the upstream advisory and was verified by the reporter against 2.0.0; no CISA KEV entry appears in the supplied data, and the vendor fix ships in 2.1.1.