Joker linter executed project-local .jokerd/linter.* files during linting
CVSS Skor
7.8
EPSS İhtimal
—
Risk Skoru
0.8
Yayın
1 ay önce
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Envanterimdeki Etkisi
Yalnızca hesabınıza eklediğiniz kişisel ürünler değerlendirilir; kurumsal envanter burada görünmez.
Oturum kontrol ediliyor…
Zafiyet Açıklaması
DayBreach CVE AI Araştırması
CVE-2026-59172 için toplanan üretici, dağıtım, yama ve güvenlik kaynağı kayıtlarını karşılaştırıp kanıt bağlantılı bir açıklama hazırlayalım.
## Impact In Joker versions before 1.8.2, `joker --lint <file>` located a `.jokerd/` directory by walking up from the linted file and executed matching `linter.*` files from that directory before linting. Because these files are executable Joker/Clojure code, linting a file inside an untrusted repository could execute code supplied by that repository. This could be triggered by editor integrations or CI jobs that automatically run `joker --lint` on checked-out source code. ## Patches Fixed in Joker v1.8.2. Executable linter customization files are now loaded only from the user's home `.jokerd` directory (`~/.jokerd/linter.cljc`, `~/.jokerd/linter.clj`, `~/.jokerd/linter.cljs`, or `~/.jokerd/linter.joke`). Project-local `.jokerd/linter.*` files are no longer executed. ## Workarounds Users who cannot upgrade should avoid running `joker --lint` on untrusted repositories, especially through editor integrations or unattended CI. Removing or disabling project-local `.jokerd/linter.*` files before linting also avoids the code-execution path. ## Credits Reported by Younghun Ko of AhnLab (@koyokr).
IMPACT — Etkilenen Ürünler ve Yazılımlar
Affected Products
The following products are affected by CVE-2026-59172 vulnerability. Even if our threat engine is aware of the exact versions of the products that are affected, the information is represented below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | go | github.com/candid82/joker | İncele |
RED HAT CSAF/VEX — Ürün Etki Kontrolü
SCORING — CVSS Çoklu Kaynak Skoru
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from various sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 7.8 | CVSS 3.x | — | Vektör yayımlanmadı | GitHub Advisory |
| 0.0 | CVSS 4.0 | — | Vektör yayımlanmadı | GitHub Advisory |
Yama ve İyileştirme Rehberi (Solution)
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit ve aktif sömürü durumu
Doğrulanmış exploit istihbaratı
Bu CVE için henüz doğrulanmış public PoC, exploit repository’si veya Metasploit modülü bulunamadı.
Zafiyet Dağılımı ve Saldırı Kalıpları (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-59172 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-59172 weaknesses.
Saldırı Vektörü ve Erişilebilirlik Karakteristiği
Resmi Kaynaklar ve Danışma Bültenleri
İlgili Benzer Açıklar
Code injection in Gitea
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
CVE-2026-76819
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-59172"