Code Execution Vulnerability in Joker Clojure Interpreter by Candid82

CVE-2026-59172

What is CVE-2026-59172?

The Joker Clojure interpreter exhibits a vulnerability that allows the execution of arbitrary code from project-local linter customizations. When linting files within untrusted repositories, the linting process (joker --lint <file>) could traverse upward to find a .jokerd/ directory, executing any linter.* files it encounters. This could potentially allow an attacker to execute malicious code with the user's privileges during linting. The issue affects all versions before 1.8.2, which addresses this concern by restricting executable customizations to the user's home directory, thereby mitigating the risk posed by untrusted linting environments.

References