CVE-2026-59172 Details
Description
Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to locate a `.jokerd/` directory and executes matching `linter.*` files before linting. Those files contain executable Joker/Clojure code, so linting a file inside an untrusted repository can execute repository-supplied code with the linter user's privileges. Editor integrations and CI jobs that automatically lint checked-out source can trigger this behavior. The patch stops executing project-local linter customizations and loads executable customization only from the user's home directory. This issue is fixed in version 1.8.2.
A vulnerability in the Joker Clojure interpreter, linter, and formatter, prior to version 1.8.2, allows for code execution through project-local linter customization files. When the linter is run on a file within an untrusted repository, it can execute repository-supplied code with the user's privileges. This issue arises because Joker, before version 1.8.2, executed linter files from a project's .jokerd directory, which could contain executable Clojure code. The vulnerability can be exploited via editor integrations or continuous integration jobs that automatically lint source code.
Users should upgrade to Joker version 1.8.2 or later, where this vulnerability is fixed. Instructions for installing Joker can be found in the project's README file.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/candid82/joker/commit/f207521ef8abc22f30740591c3de5062c1aa628c | [email protected] | Source CodeVendor |
| https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg | [email protected] | AdvisoryRemedyVendor |
| https://github.com/candid82/joker/tree/v1.8.2 | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| candid82 Joker | < 1.8.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |