---
id: CVE-2026-59172
title: Joker linter executed project-local .jokerd/linter.* files during linting
summary: >-
  Joker is a small Clojure interpreter, linter and formatter written in Go.
  Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to
  locate a `.jokerd/` directory and executes matching `linter.*` files before
  linting. Tho…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-829
vendor: candid82
product: joker
affected:
  - joker < 1.8.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-28T14:58:48.475208Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:07:17.268Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59172'
references:
  - url: 'https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg'
    label: 'https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg'
  - url: >-
      https://github.com/candid82/joker/commit/f207521ef8abc22f30740591c3de5062c1aa628c
    label: >-
      https://github.com/candid82/joker/commit/f207521ef8abc22f30740591c3de5062c1aa628c
  - url: 'https://github.com/candid82/joker/tree/v1.8.2'
    label: 'https://github.com/candid82/joker/tree/v1.8.2'
  - url: 'https://github.com/candid82/joker'
  - url: 'https://github.com/advisories/GHSA-m835-3cm9-rggg'
tags:
  - cve.org
  - osv
  - go
  - ghsa
aliases:
  - GHSA-m835-3cm9-rggg
  - GO-2026-6450
ecosystem: go
patched:
  - github.com/candid82/joker 1.8.2
ingestedAt: '2026-09-10T00:26:24.579Z'
epss: 0.00162
epssPercentile: 0.05416
---

## Overview

Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to locate a `.jokerd/` directory and executes matching `linter.*` files before linting. Those files contain executable Joker/Clojure code, so linting a file inside an untrusted repository can execute repository-supplied code with the linter user's privileges. Editor integrations and CI jobs that automatically lint checked-out source can trigger this behavior. The patch stops executing project-local linter customizations and loads executable customization only from the user's home directory. This issue is fixed in version 1.8.2.

## Affected

- `joker < 1.8.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-59172)

Affected packages:

- `github.com/candid82/joker < 1.8.2`

Patched in:

- `github.com/candid82/joker 1.8.2`

Source: https://osv.dev/vulnerability/GHSA-m835-3cm9-rggg