CVE-2026-59172 — joker
HIGHCVE-2026-59172 is a high-severity (CVSS 7.8) vulnerability in github.com/candid82/joker. A fix is available for github.com/candid82/joker — see the affected versions and patch details below.
Joker linter executed project-local .jokerd/linter.* files during linting
Real-World Exposure
github.com/candid82/jokerReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
In Joker versions before 1.8.2, joker --lint <file> located a .jokerd/ directory by walking up from the linted file and executed matching linter.* files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.
This could be triggered by editor integrations or CI jobs that automatically run joker --lint on checked-out source code.
Patches
Fixed in Joker v1.8.2. Executable linter customization files are now loaded only from the user's home .jokerd directory (~/.jokerd/linter.cljc, ~/.jokerd/linter.clj, ~/.jokerd/linter.cljs, or ~/.jokerd/linter.joke). Project-local .jokerd/linter.* files are no longer executed.
Workarounds
Users who cannot upgrade should avoid running joker --lint on untrusted repositories, especially through editor integrations or unattended CI. Removing or disabling project-local .jokerd/linter.* files before linting also avoids the code-execution path.
Credits
Reported by Younghun Ko of AhnLab (@koyokr).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/candid82/joker | all versions | 1.8.2go get github.com/candid82/joker@v1.8.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/candid82/joker, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/candid82/joker to 1.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-59172 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-59172 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-59172. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-59172 in your dependencies?
O3 Security finds CVE-2026-59172 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.