CVE-2026-63346

The Refitter tool, used to generate C# REST API clients, is vulnerable to C# source injection prior to version 2.1.2 . The root cause is the verbatim emission of header parameter names from an OpenAPI description into a Refit [Header("")] attribute without escaping quotation marks. An attacker-in...

CVE-2026-63344

The Refitter tool, used to generate C# REST API clients, contains a source code injection vulnerability prior to version 2.1.2 . The root cause is that content-type keys in the requestBody/responses content maps are emitted verbatim into a Refit [Headers] attribute string without escaping quotati...

CVE-2026-63344 Refitter: C# source injection through OpenAPI content-type map keys

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit Headers"Accept: ", "Content-Type: " attribute string without escaping quotation marks. A crafted...

CVE-2026-63345

The Refitter tool (prior to version 2.1.2 ) is vulnerable to code injection during the generation of C# REST API clients. The root cause is the verbatim emission of OpenAPI paths-object keys into Refit route attributes without proper escaping or character restriction. An attacker can provide a sp...