CVE-2026-63184

The record

Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSchema` with unsafe defaults for `$ref` resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote `http(s)` references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative `../` traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.

Affected packages

Related vulnerabilities

• CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. CWE-829
• CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher… CWE-829
• CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authentication… CWE-829
• CVE-2026-114488 A flaw was found in Wildfly. CWE-829
• CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR… CWE-829
• CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. CWE-829
• CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. CWE-829
• CVE-2026-65119 NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter… CWE-829