x/vulndb: potential Go vuln in github.com/candid82/joker: GHSA-m835-3cm9-rggg

[GoVulnBot]

Advisory GHSA-m835-3cm9-rggg references a vulnerability in the following Go modules:

Module
github.com/candid82/joker

Description:

Impact

In Joker versions before 1.8.2, joker --lint <file> located a .jokerd/ directory by walking up from the linted file and executed matching linter.* files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository.

This could be triggered by editor integrations or CI jobs that automatically run joker --lint on checked-out source code.

Patches

Fixed in Joker v1.8.2. Executable linter customization files are now loaded only from the user's home `.jok...

References:

• ADVISORY: GHSA-m835-3cm9-rggg
• ADVISORY: GHSA-m835-3cm9-rggg

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/candid82/joker
      versions:
        - fixed: 1.8.2
      vulnerable_at: 1.8.1
summary: Joker linter executed project-local .jokerd/linter.* files during linting in github.com/candid82/joker
cves:
    - CVE-2026-59172
ghsas:
    - GHSA-m835-3cm9-rggg
references:
    - advisory: https://github.com/advisories/GHSA-m835-3cm9-rggg
    - advisory: https://github.com/candid82/joker/security/advisories/GHSA-m835-3cm9-rggg
source:
    id: GHSA-m835-3cm9-rggg
    created: 2026-09-10T00:01:56.75521741Z
review_status: UNREVIEWED