CVE-2026-63344

The Refitter tool, used to generate C# REST API clients, contains a source code injection vulnerability prior to version 2.1.2 . The root cause is that content-type keys in the requestBody/responses content maps are emitted verbatim into a Refit [Headers] attribute string without escaping quotati...

CVE-2026-63344 Refitter: C# source injection through OpenAPI content-type map keys

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit Headers"Accept: ", "Content-Type: " attribute string without escaping quotation marks. A crafted...