Common Weakness Enumeration

CWE-1116

Allowed

Inaccurate Source Code Comments

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.

2 vulnerabilities reference this CWE, most recent first.

CVE-2026-63345 (GCVE-0-2026-63345)

Vulnerability from cvelistv5 – Published: 2026-10-30 22:13 – Updated: 2026-11-02 17:58
VLAI
Title
Refitter: C# source injection through OpenAPI path keys
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
  • CWE-1116 - Inaccurate Comments
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
christianhelle refitter Affected: < 2.1.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63345",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:09:18.405090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:58:04.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "refitter",
          "vendor": "christianhelle",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"\u003cpath\u003e\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1116",
              "description": "CWE-1116: Inaccurate Comments",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T22:13:53.498Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3"
        },
        {
          "name": "https://github.com/christianhelle/refitter/pull/1178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/christianhelle/refitter/pull/1178"
        },
        {
          "name": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973"
        },
        {
          "name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
        },
        {
          "name": "https://github.com/user-attachments/files/29395228/maintainer-report.txt",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt"
        },
        {
          "name": "https://github.com/user-attachments/files/29395229/make_spec.py",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/user-attachments/files/29395229/make_spec.py"
        },
        {
          "name": "https://github.com/user-attachments/files/29395230/reproduce.sh",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/user-attachments/files/29395230/reproduce.sh"
        }
      ],
      "source": {
        "advisory": "GHSA-3fhm-p725-h3g3",
        "discovery": "UNKNOWN"
      },
      "title": "Refitter: C# source injection through OpenAPI path keys"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63345",
    "datePublished": "2026-10-30T22:13:53.498Z",
    "dateReserved": "2026-07-16T14:14:24.385Z",
    "dateUpdated": "2026-11-02T17:58:04.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47271 (GCVE-0-2025-47271)

Vulnerability from cvelistv5 – Published: 2025-05-12 10:52 – Updated: 2025-05-12 12:12
VLAI
Title
OZI-Project/ozi-publish Code Injection vulnerability
Summary
The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-12 12:10 UTC
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
  • CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
  • CWE-1116 - Inaccurate Comments
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
OZI-Project publish Affected: >= 1.13.2, < 1.13.6
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-47271",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-12T12:10:34.546853Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-12T12:12:40.770Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "publish",
          "vendor": "OZI-Project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.13.2, \u003c 1.13.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1116",
              "description": "CWE-1116: Inaccurate Comments",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-12T10:52:26.916Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OZI-Project/publish/security/advisories/GHSA-2487-9f55-2vg9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OZI-Project/publish/security/advisories/GHSA-2487-9f55-2vg9"
        },
        {
          "name": "https://github.com/OZI-Project/publish/commit/abd8524ec69800890529846b3ccfb09ce7c10b5c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OZI-Project/publish/commit/abd8524ec69800890529846b3ccfb09ce7c10b5c"
        }
      ],
      "source": {
        "advisory": "GHSA-2487-9f55-2vg9",
        "discovery": "UNKNOWN"
      },
      "title": "OZI-Project/ozi-publish Code Injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-47271",
    "datePublished": "2025-05-12T10:52:26.916Z",
    "dateReserved": "2025-05-05T16:53:10.372Z",
    "dateUpdated": "2025-05-12T12:12:40.770Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation
Implementation

Verify that each comment accurately reflects what is intended to happen during execution of the code.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list