CVE-2026-63346：Refitter 透過 OpenAPI 標頭引數名稱注入 C# 原始碼
CVE-2026-63346 - Refitter: C# source injection through OpenAPI header parameter names
Refitter 工具在 2.1.2 之前的版本中，允許攻擊者在 OpenAPI 描述中注入不經轉義的標頭引數名稱，導致生成的 C# 客戶端可執行惡意程式碼。
- 漏洞影響：可在生成的 C# 檔案中注入
[ModuleInitializer]，在應用啟動時執行攻擊者程式碼，即使未呼叫客戶端。
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Impact
Affected Products
The following products are affected by CVE-2026-63346
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | [email protected] |
Update Refitter to version 2.1.2 or later to fix attribute string emission.
- Update Refitter to version 2.1.2 or later.
- Review generated code for malicious content.
- Validate OpenAPI descriptions before generation.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63346.
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63346 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63346
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63346 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63346 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
十月. 30, 2026
Action Type Old Value New Value Added Description Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].name` with `in: header` is emitted verbatim into a Refit `[Header("<name>")]` attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without `--skip-validation` and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a `[ModuleInitializer]` method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query `AliasAs` and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-94 Added CWE CWE-116 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/63xxx/CVE-2026-63346.json">CVE-2026-63346</a> Added Reference https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1 Added Reference https://github.com/christianhelle/refitter/pull/1178 Added Reference https://github.com/christianhelle/refitter/releases/tag/2.1.2 Added Reference https://github.com/christianhelle/refitter/security/advisories/GHSA-58x9-vjvp-6mx8 Added Reference https://github.com/user-attachments/files/29395048/maintainer-report.txt Added Reference https://github.com/user-attachments/files/29395050/make_spec.py Added Reference https://github.com/user-attachments/files/29395051/reproduce.sh
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.