CVE-2026-59172: Joker linter executed project-local .jokerd/linter.* files during linting

September 9, 2026

In Joker versions before 1.8.2, joker --lint <file> located a .jokerd/ directory by walking up from the linted file and executed matching linter.* files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.

This could be triggered by editor integrations or CI jobs that automatically run joker --lint on checked-out source code.

References

github.com/advisories/GHSA-m835-3cm9-rggg
github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg
nvd.nist.gov/vuln/detail/CVE-2026-59172

Code Behaviors & Features

Detect and mitigate CVE-2026-59172 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →