Refitter Vulnerability Disclosure

generated: '2026-08-06'
method: searched
probe: true
source: https://github.com/christianhelle/refitter/security/advisories
program: GitHub Security Advisories (coordinated disclosure) on christianhelle/refitter
policy:
  - https://github.com/christianhelle/refitter/security/policy
  - https://github.com/christianhelle/refitter/security/advisories
intake:
  channel: GitHub private vulnerability reporting
  url: https://github.com/christianhelle/refitter/security/advisories/new
  observed_status: 200
  note: >-
    The repository exposes GitHub's "Report a vulnerability" form, which means
    private vulnerability reporting is enabled. No SECURITY.md is published at
    the repository root or under .github/ (both 404), so the intake is GitHub's
    default form rather than a hand-written policy document.
security_txt: null
security_txt_note: >-
  /.well-known/security.txt returns 404 on refitter.github.io — the docs site is
  GitHub Pages, and the project controls no apex domain of its own.
bug_bounty: null
published_advisories:
  count: 4
  window: 2026-06-29 to 2026-06-30
  advisories:
    - id: GHSA-x6w4-f264-3vvr
      severity: high
      published: '2026-06-29'
      summary: 'Generation-time SSRF, remote file inclusion, and local file inclusion via unrestricted $ref'
      fixed_in: 2.1.1
      mitigation: 'Remote $ref resolution is now off by default; opt in with --allow-remote-refs'
    - id: GHSA-3fhm-p725-h3g3
      severity: critical
      published: '2026-06-30'
      summary: 'RCE via OpenAPI path -> unescaped [Get("...")] Refit attribute -> [ModuleInitializer] at assembly load'
      fixed_in: 2.1.2
    - id: GHSA-p32v-8v8j-j534
      severity: critical
      published: '2026-06-30'
      summary: 'RCE via content-type key (content map key in requestBody/responses) -> unescaped [Headers(...)] Refit attribute -> [ModuleInitializer] at assembly load'
      fixed_in: 2.1.2
    - id: GHSA-58x9-vjvp-6mx8
      severity: critical
      published: '2026-06-30'
      summary: 'RCE via header parameter name (parameters[].name with in: header) -> unescaped [Header("<name>")] Refit attribute -> [ModuleInitializer] at assembly load'
      fixed_in: 2.1.2
  note: >-
    All four advisories are attacker-controlled-OpenAPI attacks against the
    generator itself — the threat model is "you generated a client from a spec
    you did not write". Fixes shipped in 2.1.1 and 2.1.2 and are referenced from
    the changelog entries for those releases.
evidence:
  - {source: 'https://github.com/christianhelle/refitter/security/advisories', kind: advisory-registry, status: 200}
  - {source: 'https://github.com/christianhelle/refitter/security/policy', kind: security-policy, status: 200}
  - {source: 'https://github.com/christianhelle/refitter/security/advisories/new', kind: private-reporting-intake, status: 200}
  - {source: 'https://api.github.com/repos/christianhelle/refitter/security-advisories', kind: api, status: 200, records: 4}
  - {source: 'https://raw.githubusercontent.com/christianhelle/refitter/main/SECURITY.md', kind: security-md, status: 404}
x-evidence:
  fetched: '2026-08-06'