CVE-2026-63184

The refitter .NET tool, used to generate C# REST API clients via the Refit library, is vulnerable to Server-Side Request Forgery (SSRF) and local file inclusion prior to version 2.1.1 . The vulnerability stems from the tool's use of NJsonSchema with unsafe defaults for $ref resolution when proces...

CVE-2026-63184: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit library

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.1, the refitter dotnet tool invokes NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions...