Refitter is a tool that generates C# REST API clients from OpenAPI specifications. Before version 2.1.2 the tool emitted header parameter names directly into a [Header("<name>")] attribute. An attacker who can influence the OpenAPI description can inject characters that close the attribute and the surrounding code, allowing arbitrary C# code to appear in the generated file. The injected code can be placed in a top‑level class with a [ModuleInitializer] method, which executes when the compiled assembly is loaded at application startup, even if the client is never called. This flaw represents a code injection vulnerability (CWE‑94) combined with improper encoding (CWE‑116).

The affected product is Refitter, a code generator for the Refit library, maintained by christianhelle. All releases older than 2.1.2 are vulnerable. The fix is included in Refitter 2.1.2 and later, and the vulnerability also applies to .NET 8 builds.

The vulnerability carries a CVSS score of 8.6 and is not listed in the CISA KEV catalog; EPSS data are not available. The attack vector is inferred from the description: an attacker can supply a malicious OpenAPI spec that passes normal validation and is used by Refitter during a normal build, causing the generated assembly to contain attacker code that is executed at startup. The risk of exploitation is high because no user interaction is required beyond providing the specification.