GHSA-m835-3cm9-rggg

Source

https://github.com/advisories/GHSA-m835-3cm9-rggg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m835-3cm9-rggg/GHSA-m835-3cm9-rggg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m835-3cm9-rggg

Aliases

CVE-2026-59172

Published

2026-09-09T23:48:46Z

Modified

2026-09-10T00:10:57Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Joker linter executed project-local .jokerd/linter.* files during linting

Details

Impact

In Joker versions before 1.8.2, joker --lint <file> located a .jokerd/ directory by walking up from the linted file and executed matching linter.* files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.

This could be triggered by editor integrations or CI jobs that automatically run joker --lint on checked-out source code.

Patches

Fixed in Joker v1.8.2. Executable linter customization files are now loaded only from the user's home .jokerd directory (~/.jokerd/linter.cljc, ~/.jokerd/linter.clj, ~/.jokerd/linter.cljs, or ~/.jokerd/linter.joke). Project-local .jokerd/linter.* files are no longer executed.

Workarounds

Users who cannot upgrade should avoid running joker --lint on untrusted repositories, especially through editor integrations or unattended CI. Removing or disabling project-local .jokerd/linter.* files before linting also avoids the code-execution path.

Credits

Reported by Younghun Ko of AhnLab (@koyokr).

Database specific

{
    "cwe_ids": [
        "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:48:46Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/candid82/joker

Package

Name: github.com/candid82/joker; View open source insights on deps.dev
Purl: pkg:golang/github.com/candid82/joker

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.8.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-m835-3cm9-rggg/GHSA-m835-3cm9-rggg.json"