# CVE-2026-63344: Refitter code injection in generated Refit headers

Source: https://junglewise.ai/threats/cve-2026-63344-refitter-is-a-tool-for-generating-a-c-rest-api-client-using-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-63344 · Severity: info · Published 2026-10-30

Refitter is a code generator that creates C# REST API clients. An attacker can craft a malicious OpenAPI specification with special characters in content-type declarations that inject arbitrary C# code into the generated client. When an application compiles and loads this generated code, the injected code executes automatically at startup, giving the attacker complete control over the application.

Technologies: [Christian Helle Refitter](https://junglewise.ai/threats/technologies/refitter). Vendors: [Christian Helle](https://junglewise.ai/threats/vendors/christian-helle).

## Quick answers

**Is CVE-2026-63344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63344 being exploited in the wild.

**How severe is CVE-2026-63344?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Christian Helle Refitter prior to 2.1.2.

**Is there a fix for CVE-2026-63344?** Yes: fixed in 2.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63344 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63344?** Check whether you run Christian Helle Refitter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.1.2

## Technical details

Refitter failed to escape quotation marks and other special characters when emitting OpenAPI content-type values into Refit [Headers] attribute strings. An attacker can break out of the attribute literal by including quote characters in a content-type key, inject a top-level C# class with a [ModuleInitializer] method, and achieve code execution when the generated assembly loads—no user interaction or client method calls required. The vulnerability affects Refitter prior to 2.1.2 and does not require --skip-validation to exploit.

## Affected products

- Christian Helle Refitter prior to 2.1.2

## Timeline

- 2026-10-30: disclosed
- 2026-07-27: patched: Fix merged in PR #1178

## References

- [https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67](https://github.com/christianhelle/refitter/commit/ab4d8e439d6f0ee82ad49ee15323978d70fe5a67)
- [https://github.com/christianhelle/refitter/pull/1178](https://github.com/christianhelle/refitter/pull/1178)

## Related threats

- [Refitter C# REST client generator code injection in header attribute](https://junglewise.ai/threats/cve-2026-63346-refitter-is-a-tool-for-generating-a-c-rest-api-client-using-the)
- [Refitter unsafe $ref resolution in OpenAPI generation](https://junglewise.ai/threats/cve-2026-63184-refitter-is-a-tool-for-generating-a-c-rest-api-client-using-the)