CVE-2026-63345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63345", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T14:14:24.385Z", "datePublished": "2026-10-30T22:13:53.498Z", "dateUpdated": "2026-11-02T17:58:04.730Z"}, "containers": {"cna": {"title": "Refitter: C# source injection through OpenAPI path keys", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1116", "lang": "en", "description": "CWE-1116: Inaccurate Comments", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3"}, {"name": "https://github.com/christianhelle/refitter/pull/1178", "tags": ["x_refsource_MISC"], "url": "https://github.com/christianhelle/refitter/pull/1178"}, {"name": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973", "tags": ["x_refsource_MISC"], "url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973"}, {"name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"}, {"name": "https://github.com/user-attachments/files/29395228/maintainer-report.txt", "tags": ["x_refsource_MISC"], "url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt"}, {"name": "https://github.com/user-attachments/files/29395229/make_spec.py", "tags": ["x_refsource_MISC"], "url": "https://github.com/user-attachments/files/29395229/make_spec.py"}, {"name": "https://github.com/user-attachments/files/29395230/reproduce.sh", "tags": ["x_refsource_MISC"], "url": "https://github.com/user-attachments/files/29395230/reproduce.sh"}], "affected": [{"vendor": "christianhelle", "product": "refitter", "versions": [{"version": "< 2.1.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T22:13:53.498Z"}, "descriptions": [{"lang": "en", "value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"<path>\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."}], "source": {"advisory": "GHSA-3fhm-p725-h3g3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T17:09:18.405090Z", "id": "CVE-2026-63345", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T17:58:04.730Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63345", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T17:09:18.405090Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T17:09:23.147Z"}}], "cna": {"title": "Refitter: C# source injection through OpenAPI path keys", "source": {"advisory": "GHSA-3fhm-p725-h3g3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "christianhelle", "product": "refitter", "versions": [{"status": "affected", "version": "< 2.1.2"}]}], "references": [{"url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3", "name": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/christianhelle/refitter/pull/1178", "name": "https://github.com/christianhelle/refitter/pull/1178", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973", "name": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2", "name": "https://github.com/christianhelle/refitter/releases/tag/2.1.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt", "name": "https://github.com/user-attachments/files/29395228/maintainer-report.txt", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/user-attachments/files/29395229/make_spec.py", "name": "https://github.com/user-attachments/files/29395229/make_spec.py", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/user-attachments/files/29395230/reproduce.sh", "name": "https://github.com/user-attachments/files/29395230/reproduce.sh", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"<path>\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1116", "description": "CWE-1116: Inaccurate Comments"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-30T22:13:53.498Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63345", "state": "PUBLISHED", "dateUpdated": "2026-11-02T17:58:04.730Z", "dateReserved": "2026-07-16T14:14:24.385Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-30T22:13:53.498Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "refitter", "vendor": "christianhelle", "versions": [{"status": "affected", "version": "< 2.1.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get(\"<path>\")]` without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without `--skip-validation` and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A `[ModuleInitializer]` method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2."}], "id": "CVE-2026-63345", "lastModified": "2026-11-02T19:35:33.347", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63345", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T17:09:18.405090Z", "version": "2.0.3"}}]}, "published": "2026-10-30T23:17:13.987", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/christianhelle/refitter/commit/793d2632899c2022511dfc15e30725ef69073973"}, {"source": "security-advisories@github.com", "url": "https://github.com/christianhelle/refitter/pull/1178"}, {"source": "security-advisories@github.com", "url": "https://github.com/christianhelle/refitter/releases/tag/2.1.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/christianhelle/refitter/security/advisories/GHSA-3fhm-p725-h3g3"}, {"source": "security-advisories@github.com", "url": "https://github.com/user-attachments/files/29395228/maintainer-report.txt"}, {"source": "security-advisories@github.com", "url": "https://github.com/user-attachments/files/29395229/make_spec.py"}, {"source": "security-advisories@github.com", "url": "https://github.com/user-attachments/files/29395230/reproduce.sh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "refitter", "source": "cna", "vendor": "christianhelle"}, "product": "refitter", "vendor": "christianhelle"}], "created": "2026-10-31T00:00:27.655381+00:00", "updated": "2026-11-03T16:32:27.713067+00:00", "vendors": ["christianhelle", "christianhelle$PRODUCT$refitter"]}