CVE-2026-63345 (GCVE-0-2026-63345)
Vulnerability from cvelistv5
Published
2026-10-30 22:13
Modified
2026-11-02 17:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| christianhelle | refitter |
Version: < 2.1.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:18.405090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:58:04.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "refitter",
"vendor": "christianhelle",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"\u003cpath\u003e\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1116",
"description": "CWE-1116: Inaccurate Comments",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:13:53.498Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3"
},
{
"name": "https://github.com/christianhelle/refitter/pull/1178",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/pull/1178"
},
{
"name": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973"
},
{
"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"
},
{
"name": "https://github.com/user-attachments/files/29395228/maintainer-report.txt",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt"
},
{
"name": "https://github.com/user-attachments/files/29395229/make_spec.py",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395229/make_spec.py"
},
{
"name": "https://github.com/user-attachments/files/29395230/reproduce.sh",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/user-attachments/files/29395230/reproduce.sh"
}
],
"source": {
"advisory": "GHSA-3fhm-p725-h3g3",
"discovery": "UNKNOWN"
},
"title": "Refitter: C# source injection through OpenAPI path keys"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63345",
"datePublished": "2026-10-30T22:13:53.498Z",
"dateReserved": "2026-07-16T14:14:24.385Z",
"dateUpdated": "2026-11-02T17:58:04.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-63345\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-02T17:09:18.405090Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-02T17:09:23.147Z\"}}], \"cna\": {\"title\": \"Refitter: C# source injection through OpenAPI path keys\", \"source\": {\"advisory\": \"GHSA-3fhm-p725-h3g3\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"userInteraction\": \"ACTIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"christianhelle\", \"product\": \"refitter\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.1.2\"}]}], \"references\": [{\"url\": \"https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3\", \"name\": \"https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/christianhelle/refitter/pull/1178\", \"name\": \"https://github.com/christianhelle/refitter/pull/1178\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973\", \"name\": \"https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/christianhelle/refitter/releases/tag/2.1.2\", \"name\": \"https://github.com/christianhelle/refitter/releases/tag/2.1.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/user-attachments/files/29395228/maintainer-report.txt\", \"name\": \"https://github.com/user-attachments/files/29395228/maintainer-report.txt\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/user-attachments/files/29395229/make_spec.py\", \"name\": \"https://github.com/user-attachments/files/29395229/make_spec.py\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/user-attachments/files/29395230/reproduce.sh\", \"name\": \"https://github.com/user-attachments/files/29395230/reproduce.sh\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\\\"\u003cpath\u003e\\\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1116\", \"description\": \"CWE-1116: Inaccurate Comments\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-10-30T22:13:53.498Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-63345\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-02T17:58:04.730Z\", \"dateReserved\": \"2026-07-16T14:14:24.385Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-10-30T22:13:53.498Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…