Joker linter executed project-local .jokerd/linter.* files during linting
Impact
Joker, a Clojure interpreter, linter, and formatter, executes project-local .jokerd/linter.* files during linting in versions prior to 1.8.2, allowing untrusted repository code to run with user privileges. The issue is fixed in version 1.8.2. Local access is required to exploit this weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
candid82 · GitHub_M
joker
1 range
candid82 · GitHub_M
joker
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 1.8.2
Other versions: unknown
Original source description
Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, joker --lint <file> walks upward from the linted file to locate a .jokerd/ directory and executes matching linter.* files before linting. Those files contain executable Joker/Clojure code, so linting a file inside an untrusted repository can execute repository-supplied code with the linter user's privileges. Editor integrations and CI jobs that automatically lint checked-out source can trigger this behavior. The patch stops executing project-local linter customizations and loads executable customization only from the user's home directory. This issue is fixed in version 1.8.2.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-59172View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.