{"id":"EUVD-2026-112077","enisaUuid":"988b44e5-6b92-35dc-9d3a-c620ba26dfb2","description":"Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint \u003cfile\u003e` walks upward from the linted file to locate a `.jokerd/` directory and executes matching `linter.*` files before linting. Those files contain executable Joker/Clojure code, so linting a file inside an untrusted repository can execute repository-supplied code with the linter user\u0027s privileges. Editor integrations and CI jobs that automatically lint checked-out source can trigger this behavior. The patch stops executing project-local linter customizations and loads executable customization only from the user\u0027s home directory. This issue is fixed in version 1.8.2.","datePublished":"Oct 28, 2026, 1:07:35 PM","dateUpdated":"Oct 28, 2026, 4:07:17 PM","baseScore":7.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg\nhttps://github.com/candid82/joker/commit/f207521ef8abc22f30740591c3de5062c1aa628c\nhttps://github.com/candid82/joker/tree/v1.8.2\n","aliases":"CVE-2026-59172\nGHSA-m835-3cm9-rggg\n","assigner":"GitHub_M","epss":0.16,"enisaIdProduct":[{"id":"03fbf12e-b6a0-3657-a59e-1439b1d95a1e","product":{"name":"joker","vendor":{"name":"candid82"}},"product_version":"\u003c 1.8.2"}],"enisaIdVendor":[{"id":"a209426d-fec7-3205-bbb3-0930187ec414","vendor":{"name":"candid82"}}],"enisaIdVulnerability":[{"id":"2d2dace6-df74-3cd2-8888-aa4e00d591bf","vulnerability":{"id":"CVE-2026-59172","description":"Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint \u003cfile\u003e` walks upward from the linted file to locate a `.jokerd/` directory and executes matching `linter.*` files before linting. Those files contain executable Joker/Clojure code, so linting a file inside an untrusted repository can execute repository-supplied code with the linter user\u0027s privileges. Editor integrations and CI jobs that automatically lint checked-out source can trigger this behavior. The patch stops executing project-local linter customizations and loads executable customization only from the user\u0027s home directory. This issue is fixed in version 1.8.2.","datePublished":"Oct 28, 2026, 1:07:35 PM","dateUpdated":"Oct 28, 2026, 4:07:17 PM","status":"PUBLISHED","baseScore":7.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg\nhttps://github.com/candid82/joker/commit/f207521ef8abc22f30740591c3de5062c1aa628c\nhttps://github.com/candid82/joker/tree/v1.8.2\n","enisa_id":"EUVD-2026-112077\n","assigner":"GitHub_M","epss":0.16,"dataProcessed":"Oct 30, 2026, 12:00:36 PM","vulnerabilityProduct":[{"id":"e059db1c-b46f-3b3d-abf3-8322ae12f4a4","product":{"name":"joker","vendor":{"name":"candid82"}},"product_version":"\u003c 1.8.2"}],"vulnerabilityVendor":[{"id":"78e856ef-b449-3cbf-a0e7-dd885f66677e","vendor":{"name":"candid82"}}]}},{"id":"49d36a14-52c0-3030-a223-0cbd900d9a9b","vulnerability":{"id":"GHSA-m835-3cm9-rggg","description":"Joker linter executed project-local .jokerd/linter.* files during linting","datePublished":"Sep 9, 2026, 11:48:46 PM","dateUpdated":"Sep 9, 2026, 11:48:46 PM","baseScore":0.0,"references":"https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg\nhttps://github.com/candid82/joker\n","enisa_id":"EUVD-2026-112077\n","aliases":"GHSA-m835-3cm9-rggg\nCVE-2026-59172\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}