The vulnerability arises from Refitter's practice of inserting OpenAPI 'paths' keys directly into C# route attributes without escaping quotation marks or restricting characters, allowing an attacker-controlled path to terminate the attribute string, inject a new top-level class, and close the generated code structure; when the resulting assembly contains a [ModuleInitializer] method, that code executes automatically upon loading, enabling arbitrary code execution during application startup, which corresponds to CWE-1116 (Code Injection) and CWE-94 (Improper Validation of Input Leading to Code Injection).

The affected product is Refitter, a C# client code generator that embeds OpenAPI 'paths' into Refit route attributes; all non-2.1.2 releases, including version 2.0.0, are impacted, and the developer Christianhelle issued the fix in the 2.1.2 release, meaning any project that compiles and loads a Refitter-generated assembly before that update is vulnerable.

The CVSS score of 8.6 indicates high severity; without an EPSS score we cannot quantify exploitation prevalence, but it is not listed in CISA's KEV catalog; the attack requires control over the OpenAPI spec processed by Refitter, and when a malicious specification is used to generate code that is compiled and loaded, the embedded ModuleInitializer automatically executes at startup; such a scenario can arise in develop or CI pipelines that process untrusted specifications or in production if a repository accepts attacker-supplied specs; the vulnerability therefore poses a remote code execution risk at application launch.