Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59172— Joker linter executed project-local .jokerd/linter.* files during linting

Quick assessment

Affected
candid82 joker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joker 是一个用 Go 编写的轻量级 Clojure 解释器、代码检查器（linter）和代码格式化工具。在 1.8.2 版本之前，执行 时，会从待检查文件所在目录向上遍历，以查找 目录，并在执行代码检查之前运行该目录中所有匹配 模式的文件。这些文件包含可执行的 Joker/Clojure 代码，因此，对位于不可信仓库中的文件执行代码检查，可能导致以代码检查器用户权限执行由仓库提供的恶意代码。集成在编辑器中或 CI 工作流中的自动化代码检查功能（针对已检出的源码）可能触发此行为。修复方案是停止执行项目本地的代码

CVSS 7.8 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
candid82 joker < 1.8.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59172

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joker linter executed project-local .jokerd/linter.* files during linting
Source: CVE Program / CVE List V5
Vulnerability Description
Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to locate a `.jokerd/` directory and executes matching `linter.*` files before linting. Those files contain executable Joker/Clojure code, so linting a file inside an untrusted repository can execute repository-supplied code with the linter user's privileges. Editor integrations and CI jobs that automatically lint checked-out source can trigger this behavior. The patch stops executing project-local linter customizations and loads executable customization only from the user's home directory. This issue is fixed in version 1.8.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
从非可信控制范围包含功能例程
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
candid82 joker < 1.8.2 -

II. Public POCs for CVE-2026-59172

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59172

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59172 (1)

Vendor Advisories for CVE-2026-59172 (1)

Vendor Pages for CVE-2026-59172 (1)

IV. Related Vulnerabilities

Same weakness: CWE-829