CVE-2026-59172: High severity go/github.com/candid82/joker vulnerability
Impact
In Joker versions before 1.8.2, joker --lint <file> located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.
This could be triggered by editor integrations or CI jobs that automatically run joker --lint on checked-out source code.
Patches
Fixed in Joker v1.8.2. Executable linter customization files are now loaded only from the user's home .jokerd directory (~/.jokerd/linter.cljc, ~/.jokerd/linter.clj, ~/.jokerd/linter.cljs, or ~/.jokerd/linter.joke). Project-local .jokerd/linter. files are no longer executed.
Workarounds
Users who cannot upgrade should avoid running joker --lint on untrusted repositories, especially through editor integrations or unattended CI. Removing or disabling project-local .jokerd/linter. files before linting also avoids the code-execution path.
Credits
Reported by Younghun Ko of AhnLab (@koyokr).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/candid82/jokerto a version that resolves this vulnerability.Fixed in 1.8.2 - Upgrade
Upgrade
Jokerto a version that resolves this vulnerability.Fixed in 1.8.2 - Configuration
Ensure Joker is not using project-local linter customization files (e.g., do not allow execution of .jokerd/linter.cljc, .jokerd/linter.clj, .jokerd/linter.cljs, or .jokerd/linter.joke from within the repository).
Joker linter configuration loading Project-local .jokerd/linter.* execution = disabled - Compensating control
Avoid running `joker --lint <file>` on untrusted repositories, especially via editor integrations or unattended CI jobs that automatically lint checked-out source code.
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Users of Joker before 1.8.2 who lint files within untrusted repositories are exposed. Editor integrations and unattended CI jobs are particularly at risk when they automatically invoke `joker --lint` on checked-out source code.
What must an attacker provide to trigger code execution?
An attacker needs to place a matching executable `linter.*` file in a project-local `.jokerd/` directory and cause a vulnerable Joker installation to run `joker --lint` on a file under that directory tree. No privileges are required, but user interaction is required under the supplied severity vector.
Are project-local linter customization files still executed after the fix?
No. In Joker 1.8.2, executable linter customization is loaded only from the user's home `.jokerd` directory, and project-local `.jokerd/linter.*` files are no longer executed.
What can be done if upgrading is not immediately possible?
Do not run `joker --lint` against untrusted repositories, including through editor automation or unattended CI. Removing or disabling project-local `.jokerd/linter.*` files before linting also prevents this code-execution path.