Refitter versions prior to 2.1.1 contain a vulnerability where the tool uses unsafe defaults for JSON schema $ref resolution when processing attacker-controlled OpenAPI descriptions. This allows remote HTTP(S) references to be fetched and inlined, and local file paths including directory traversal to be resolved and included, leading to server-side request forgery, remote file inclusion, and local file disclosure. The issue does not lead to code execution due to runtime URL setting and string escaping. The vulnerability is fixed in version 2.1.1.