- Yama var
- Son 7 gün
- CWE-94
- CWE-1116
CVE-2026-63345
Refitter: C# source injection through OpenAPI path keys
- Yayımlandı
- Güncellendi
- 31 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as [Get("<path>")] without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without --skip-validation and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A [ModuleInitializer] method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| christianhelle refitter | < 2.1.2 | 2.1.2 |
Kaynaklar9 kaynak
- CVE.org kaydı
- NVD kaydı
- github.com/…fitter/security/advisories/GHSA-3fhm-p725-h3g3 Diğer
- github.com/christianhelle/refitter/pull/1178 Diğer
- github.com/…ommit/793d2632899c2022511dfc15e30725ef69073973 Diğer
- github.com/christianhelle/refitter/releases/tag/2.1.2 Diğer
- github.com/…tachments/files/29395228/maintainer-report.txt Diğer
- github.com/user-attachments/files/29395229/make_spec.py Diğer
- github.com/user-attachments/files/29395230/reproduce.sh Diğer
Kayıt geçmişi
- Yayımlandı