GHSA-m835-3cm9-rggg: High severity go/github.com/candid82/joker vulnerability
Impact
In Joker versions before 1.8.2, joker --lint <file> located a .jokerd/ directory by walking up from the linted file and executed matching linter. files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.
This could be triggered by editor integrations or CI jobs that automatically run joker --lint on checked-out source code.
Patches
Fixed in Joker v1.8.2. Executable linter customization files are now loaded only from the user's home .jokerd directory (~/.jokerd/linter.cljc, ~/.jokerd/linter.clj, ~/.jokerd/linter.cljs, or ~/.jokerd/linter.joke). Project-local .jokerd/linter. files are no longer executed.
Workarounds
Users who cannot upgrade should avoid running joker --lint on untrusted repositories, especially through editor integrations or unattended CI. Removing or disabling project-local .jokerd/linter. files before linting also avoids the code-execution path.
Credits
Reported by Younghun Ko of AhnLab (@koyokr).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/candid82/jokerto a version that resolves this vulnerability.Fixed in 1.8.2 - Upgrade
Upgrade
Jokerto a version that resolves this vulnerability.Fixed in 1.8.2 - Configuration
Ensure Joker does not execute project-local linter customization files by removing or disabling any `.jokerd/linter.cljc`, `.jokerd/linter.clj`, `.jokerd/linter.cljs`, or `.jokerd/linter.joke` files in the project before running `joker --lint`.
Joker linter customization files Project-local .jokerd/linter.* loading = disabled - Compensating control
Avoid running `joker --lint <file>` on untrusted repositories, especially via editor integrations or unattended CI jobs that automatically lint checked-out source code.
Event History
Frequently Asked Questions
Who is most exposed to exploitation?
Users who lint files from untrusted repositories are exposed, particularly where editor integrations or unattended CI automatically invoke `joker --lint` on checked-out source code. The vulnerable behavior can execute repository-supplied code during linting.
What must an attacker provide to trigger the issue?
An attacker needs a repository containing a `.jokerd/` directory with a matching executable `linter.*` file, and must cause a victim to run `joker --lint` on a file within that repository. No privileges are required from the attacker, but victim interaction is required to lint the file.
Are project-local linter customizations still loaded after the fix?
No. In Joker v1.8.2, executable linter customization files are loaded only from the user's home `.jokerd` directory; project-local `.jokerd/linter.*` files are no longer executed.
What can be done when upgrading is not immediately possible?
Do not run `joker --lint` against untrusted repositories, including through automatic editor or CI workflows. Before linting, remove or disable any project-local `.jokerd/linter.*` files.