# CVE-2026-63346: Refitter C# REST client generator code injection in header attribute

Source: https://junglewise.ai/threats/cve-2026-63346-refitter-is-a-tool-for-generating-a-c-rest-api-client-using-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-63346 · Severity: info · Published 2026-10-30

Refitter is a code generator that creates C# REST API clients from OpenAPI descriptions. A flaw in header parameter name handling allows an attacker to inject malicious C# code into generated source files through a crafted OpenAPI specification, achieving remote code execution when the compiled assembly loads at application startup without requiring the client to be called.

Technologies: [Christian Helle Refitter](https://junglewise.ai/threats/technologies/refitter). Vendors: [Christian Helle](https://junglewise.ai/threats/vendors/christian-helle).

## Quick answers

**Is CVE-2026-63346 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63346 being exploited in the wild.

**How severe is CVE-2026-63346?** Informational severity, published 30 October 2026.

**Which products and versions are affected?** Christian Helle Refitter prior to 2.1.2.

**Is there a fix for CVE-2026-63346?** Yes: fixed in 2.1.2. Until then: Upgrade to version 2.1.2 or later. If upgrading is not immediately possible, avoid using Refitter to generate clients from untrusted or externally-sourced OpenAPI specifications. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63346 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63346?** Check whether you run Christian Helle Refitter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.1.2

Upgrade to version 2.1.2 or later. If upgrading is not immediately possible, avoid using Refitter to generate clients from untrusted or externally-sourced OpenAPI specifications.

## Technical details

The vulnerability is an attribute string injection flaw in HeaderParameterExtractor where header parameter names from OpenAPI specifications are emitted verbatim into Refit `[Header("...")]` attributes without escaping quotation marks. An attacker can craft an OpenAPI description that breaks out of the attribute string, closes the interface and namespace, and injects a top-level C# class with a `[ModuleInitializer]` method, achieving code execution at assembly load. The generated code remains valid C# and compiles successfully. This is fixed in version 2.1.2 by escaping special characters in header parameter names.

## Affected products

- Christian Helle Refitter prior to 2.1.2

## Timeline

- 2026-10-30: disclosed: CVE-2026-63346 published
- 2026-07-27: patched: Fix merged in version 2.1.2

## References

- [https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1](https://github.com/christianhelle/refitter/commit/63a19b03699a9c267d6fab5f758ec26484db83a1)
- [https://github.com/christianhelle/refitter/pull/1178](https://github.com/christianhelle/refitter/pull/1178)

## Related threats

- [Refitter code injection in generated Refit headers](https://junglewise.ai/threats/cve-2026-63344-refitter-is-a-tool-for-generating-a-c-rest-api-client-using-the)
- [Refitter unsafe $ref resolution in OpenAPI generation](https://junglewise.ai/threats/cve-2026-63184-refitter-is-a-tool-for-generating-a-c-rest-api-client-using-the)