## Release notes
### hledger 1.52.3
- Uses hledger-lib 1.52.3.
### hledger-ui 1.52.3
- Uses hledger 1.52.3.
### hledger-web 1.52.3
Fixes
- Another XSS (cross-site scripting) vulnerability has been fixed, in
the add transaction form's error message. Any web page visited while
hledger-web was running could use it to run javascript in
hledger-web's origin, and from there read the whole journal, or
alter it. All hledger-web users should upgrade. See also:
GHSA-vq7r-8w52-jv84. (Arthur Cinader, Simon Michael, [#2700])
- A newline submitted in a transaction's description, code or account
name is no longer written into the journal file. This removes the
possibility of the user inserting an include directive, which could
expose system files readable by the hledger-web server. See also:
GHSA-vq7r-8w52-jv84. [#2704]
Note: as with [#2698] in 1.52.2, these fixes were backported from
AI-assisted fixes in hledger 2, under the security exception in
https://hledger.org/AI.html; they have been reviewed and tested.
- hledger-web's official binaries, and builds from the hledger source
tree, now use aeson 2.3, avoiding a denial of service bug.
(<https: haskell.github.io security-advisories advisory hsec-2026-0007.html>)
[#2700]: https://github.com/simonmichael/hledger/issues/2700
[#2704]: https://github.com/simonmichael/hledger/issues/2704
### credits 1.52.3
Simon Michael,
Arthur Cinader.
## Install
For all install options, see [hledger.org: Install](https://hledger.org/install).
You can install hledger from most package managers (but check for a green badge indicating it's up to date).
Or you can build it from source yourself.
Or you can install up to date binaries from this page, by following the appropriate instructions below.
If you find problems with these instructions, please [let us know](https://hledger.org/support).
Updates to binaries:
- 2026-01-12: Fixed the hledger-linux-x64.tar.gz asset below, it previously contained a dev build. [#2526](https://github.com/simonmichael/hledger/issues/2526)
<xdetails>
### All platforms
If you have [eget](https://github.com/zyedidia/eget), that's a convenient way to download the right binaries for your machine:
eget simonmichael/hledger --all
Otherwise:
</xdetails>
<xdetails>
### GNU/Linux, 64-bit Intel
At the command line:
curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-linux-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version # should show 1.52.3
</xdetails>
<xdetails>
### Mac, 64-bit ARM or Intel
In a terminal window (don't download the binaries with your web browser, they won't get authorised):
On ARM macs:
curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-mac-arm64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version # should show 1.52.3
On Intel macs:
curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-mac-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version # should show 1.52.3
</xdetails>
<xdetails>
### Windows, 64-bit ARM or Intel
In a powershell window (press `WINDOWS-R`, `powershell`, `ENTER`):
cd ~
curl https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-windows-x64.zip -OutFile hledger-windows-x64.zip
Expand-Archive hledger-windows-x64.zip -Force -DestinationPath AppData\Roaming\local\bin
hledger --version; hledger-ui --version; hledger-web --version # should show 1.52.3
</xdetails>
<xdetails>
### Windows 7, 64-bit Intel
These instructions have not been tested recently, please [let us know](https://hledger.org/support) if they work for you:
- click hledger-windows-x64.zip below
- choose Open with Windows Explorer, OK
- click Extract all files
- choose a destination folder - ideally one that appears in `echo %PATH%`, like `C:\Windows` (though that one will require administrator permission); otherwise, your home directory (`C:\Users\YOURNAME`)
- check "Show extracted files when complete"
- click Extract, wait for the destination folder to open
- find the hledger, hledger-web icons (if you extracted to `\Windows`, you'll need to scroll down)
- for each icon: double-click, uncheck "Always ask before opening this file", click Run
- close those Explorer windows
- open a command window (press Windows-r, type CMD, press enter)
- `hledger --version; hledger-ui --version; hledger-web --version` should show 1.52.3
- `echo # >> .hledger.journal` to ensure a default journal file exists. (Important: the doubled **>>** is needed to avoid overwriting existing data.)
Problems:
- Starting hledger by double-clicking its icon won't work because it needs arguments; run it from the command window instead.
- Starting hledger-web by double-clicking its icon may fail eg because Explorer's command window is too small;
configure that to be larger, or run hledger-web from a command window instead.
- hledger or hledger-web may fail to run if there is not enough memory available.
</xdetails>
### Next steps
Once installed, run `hledger`, and perhaps read [hledger.org: Quick start](https://hledger.org/#quick-start).
Source: README.md, updated 2026-08-27
