Refitter, a C# client generator that uses the Refit library, was found to emit content-type values from OpenAPI specification files directly into generated Refit attributes without escaping quotation marks. An attacker who can supply a crafted OpenAPI document can inject unescaped characters that terminate the attribute string and escape the surrounding code, allowing them to inject a top-level class containing a [ModuleInitializer] method. When the generated assembly is loaded during application startup, that method executes arbitrary attacker code, resulting in remote code execution.

Applications built with Refitter versions prior to 2.1.2 are impacted. The vulnerability applies to all releases from the beginning of the project up through 2.1.1, including the widely used 2.0.0 and the 2.1.0 series. The affected product is Christian Helle’s Refitter tool, and any software that incorporates generated code from those versions is at risk if it loads the resulting assembly.

The flaw carries a CVSS score of 8.6, indicating high severity. The exploit explanation shows that an attacker must supply a malicious OpenAPI specification; the attack requires no further network interaction once the code is generated, suggesting a moderate to low exploitation probability in the wild. The vulnerability is not currently listed in the CISA KEV catalog and no public exploit code has been published, but the potential for arbitrary code execution at application launch makes it a serious risk for systems that compile and run Refitter output.