Executive brief
Joker is a linter for the Clojure programming language used by developers to check code quality. Versions before 1.8.2 execute custom Clojure code from `.jokerd/linter.*` files found in project directories during linting operations. An attacker can embed malicious code in a repository that runs with the privileges of the developer or CI system when linting is performed, potentially leading to credential theft, data exfiltration, or system compromise.
Technical details
The vulnerability is an arbitrary code execution flaw (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) in Joker's linter configuration loading mechanism. When executing `joker --lint <file>`, versions before 1.8.2 search for `.jokerd/` directories by walking up the filesystem from the file being linted and execute any matching `linter.cljc`, `linter.clj`, `linter.cljs`, or `linter.joke` files found. These files contain executable Clojure code, so an attacker can place a malicious configuration file in a repository's `.jokerd/` directory. The vulnerability is triggered whenever linting is performed on the untrusted repository, which commonly occurs through automatic editor linting integration or unattended CI/CD jobs. No authentication is required and user interaction is limited to performing a linting operation. The attack vector is local (filesystem-based), but the practical impact is high since CI systems and development environments typically run with significant privileges. The fix in v1.8.2 restricts linter customization files to the user's home directory (`~/.jokerd/`) only.
Affected products
- candid82 Joker < 1.8.2
Timeline
- 2026-06-20: disclosed
- 2026-06-20: patched: Fixed in Joker v1.8.2
- 2026-09-09: advisory