HIGH 7.8 GitHub
CVE-2026-59172
Joker linter executed project-local .jokerd/linter.* files during linting
## Impact
In Joker versions before 1.8.2, `joker --lint <file>` located a `.jokerd/` directory by walking up from the linted file and executed matching `linter.*` files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.
This could be triggered by editor integrations or CI jobs that automatically run `joker --lint` on checked-out source code.
## Patches
Fixed i
Affected Products
- go/github.com/candid82/joker < 1.8.2
References
- https://github.com/advisories/GHSA-m835-3cm9-rggg
- https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg
- https://github.com/advisories/GHSA-m835-3cm9-rggg
This high severity vulnerability with a CVSS score of 7.8 was published on 2026-09-09 via GitHub. Affected: go/github.com/candid82/joker < 1.8.2.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.