CVE-2026-59172

Joker, a Clojure/ClojureScript linter written in Go, allowed arbitrary code execution because versions before 1.8.2 searched for a `.jokerd/` directory by walking up from the file being linted and executed any `linter.*` files found there. An attacker who controls a repository can therefore plant malicious `linter.clj`/`linter.cljc`/`linter.cljs`/`linter.joke` files that run with the privileges of the user or CI runner as soon as `joker --lint` is run on any file in that checkout. The flaw is most likely to be triggered by editor integrations or automated CI jobs that lint checked-out source code without review. Anyone running Joker versions before 1.8.2 against untrusted repositories is affected, while linting only one's own trusted projects carries little risk. No public proof-of-concept is known, the issue is not in the CISA KEV catalog, and there are no reports of exploitation in the wild.

What to do: Upgrade to Joker v1.8.2, which executes linter customization files only from the user's home `~/.jokerd` directory and no longer runs project-local `.jokerd/linter.*` files. Until upgraded, avoid running `joker --lint` on untrusted repositories, especially via editor integrations or unattended CI jobs, and remove or disable any project-local `.jokerd/linter.*` files before linting. Review recently cloned or CI-processed repositories for unexpected `.jokerd/linter.*` files.