Joker linter executed project-local .jokerd/linter.* files during linting

Published September 9, 2026 CVE-2026-59172

Joker can execute code supplied by an untrusted project when linting that project. This can happen through editor integrations or automated CI jobs.

Severity
HighCVSS 7.8
Fix
Fixed in 1.8.2Fix recorded yesterday
Affected versions
before 1.8.2
Affects
candid82/joker

How it works

  • Before version 1.8.2, Joker searched upward from the file being checked for project-local .jokerd folders.
  • It executed matching linter files before checking the code.
  • Editor integrations or CI jobs that automatically run joker --lint on checked-out source code could trigger this behavior.

What to do

Check the installed Joker version against the vendor advisory. versions older than 1.8.2 are affected.

Update Joker to version 1.8.2 or later. If updating is not possible, avoid linting untrusted repositories, especially through editor integrations or unattended CI jobs.

Technical details

Affected software: candid82/joker

CVE-2026-59172 affects Joker versions older than 1.8.2. The linter executed project-local .jokerd/linter. files, which are executable Joker or Clojure code, before linting the project.

References

View Original Source