1.52.3

Release notes

hledger 1.52.3

• Uses hledger-lib 1.52.3.

hledger-ui 1.52.3

• Uses hledger 1.52.3.

hledger-web 1.52.3

Fixes

• Another XSS (cross-site scripting) vulnerability has been fixed, in
  the add transaction form's error message. Any web page visited while
  hledger-web was running could use it to run javascript in
  hledger-web's origin, and from there read the whole journal, or
  alter it. All hledger-web users should upgrade. See also:
  GHSA-vq7r-8w52-jv84. (Arthur Cinader, Simon Michael, #2700)

• A newline submitted in a transaction's description, code or account
  name is no longer written into the journal file. This removes the
  possibility of the user inserting an include directive, which could
  expose system files readable by the hledger-web server. See also:
  GHSA-vq7r-8w52-jv84. #2704

  Note: as with #2698 in 1.52.2, these fixes were backported from
  AI-assisted fixes in hledger 2, under the security exception in
  https://hledger.org/AI.html; they have been reviewed and tested.

• hledger-web's official binaries, and builds from the hledger source
  tree, now use aeson 2.3, avoiding a denial of service bug.
  (https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html)

credits 1.52.3

Simon Michael,
Arthur Cinader.

Install

The hledger Install page lists the easiest ways to install a recent release,
such as brew on macos, choco/scoop/winget on Windows, or eget on all platforms.

Or, follow these instructions to install the specific release binaries below:

Updates to binaries:

• 2026-01-12: Fixed the hledger-linux-x64.tar.gz asset below, it previously contained a dev build. #2526

GNU/Linux, 64-bit Intel

At the command line:

curl -fL https://github.com/plaintextaccounting/hledger/releases/download/1.52.3/hledger-linux-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

Prefix tar with sudo if /usr/local/bin is not writable.

Mac, 64-bit ARM or Intel

Open a terminal window.
(Don't download these binaries with your web browser - they won't get authorised.)

On ARM macs:

sudo mkdir -p /usr/local/bin
curl -fL https://github.com/plaintextaccounting/hledger/releases/download/1.52.3/hledger-mac-arm64.tar.gz | sudo tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

On Intel macs:

sudo mkdir -p /usr/local/bin
curl -fL https://github.com/plaintextaccounting/hledger/releases/download/1.52.3/hledger-mac-x64.tar.gz | sudo tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

If the version check shows an older version, you have another hledger earlier in $PATH; which -a hledger will find it.

Windows, 64-bit ARM or Intel

In a powershell window (press WINDOWS-R, powershell, ENTER).
(Don't download the zip with your web browser - programs downloaded that way may be blocked when you run them.)

cd ~
curl.exe -fLO https://github.com/plaintextaccounting/hledger/releases/download/1.52.3/hledger-windows-x64.zip
Expand-Archive hledger-windows-x64.zip -Force -DestinationPath "$env:LOCALAPPDATA\Programs\hledger"

$env:LOCALAPPDATA\Programs\hledger (ie C:\Users\YOURNAME\AppData\Local\Programs\hledger) is not in $env:Path by default,
so if $env:Path doesn't show it, add it once:

[Environment]::SetEnvironmentVariable('Path', "$env:LOCALAPPDATA\Programs\hledger;" + [Environment]::GetEnvironmentVariable('Path','User'), 'User')
$env:Path = "$env:LOCALAPPDATA\Programs\hledger;$env:Path"    # for this window; new windows will pick it up automatically

Then:

hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

If the version check shows an older version, you have another hledger earlier in $env:Path; where.exe hledger will find it.

These are 64-bit Intel binaries; they also run on ARM machines (emulated).

They may also work on Windows 7:
use Windows Explorer to extract hledger-windows-x64.zip into a folder of your choice,
then open a command window (WINDOWS-R, cmd, ENTER) and run the hledger programs.

Next steps

Once installed, run hledger,
and see the hledger Docs.