CVE-2026-59172

Name of the Vulnerable Software and Affected Versions Joker versions prior to 1.8.2

Description When using the joker --lint <file> command, the software searches for a .jokerd/ directory by traversing upwards from the target file and executes any matching linter.* files found within that directory. Since these files contain executable Joker/Clojure code, linting a file within an untrusted repository allows for arbitrary code execution. This issue can be triggered by CI jobs or editor integrations that automatically run the linting process on checked-out source code.

Recommendations Update to version 1.8.2. Avoid running joker --lint on untrusted repositories, particularly via unattended CI or editor integrations. Remove or disable project-local .jokerd/linter.* files before performing linting.