PT-2026-134239
CVE-2026-63345
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 4.0
8.6
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Refitter versions prior to 2.1.2
Description
Refitter fails to escape quotation marks or restrict characters when emitting OpenAPI
paths-object keys into Refit route attributes, such as [Get("<path>")]. An attacker can provide a specially crafted single-line, slash-prefixed path that closes the attribute string, interface, and namespace to introduce a top-level file class. By using a [ModuleInitializer] method, attacker-controlled code can be executed when the application compiles and loads the generated assembly at startup, regardless of whether the generated client is called.Recommendations
Update to version 2.1.2.
Found an issue in the description? Have something to add? Feel free to write us 👾