plaintextaccounting/hledger 1.52.3

on GitHub

hledger 1.52.3

• Uses hledger-lib 1.52.3.

hledger-ui 1.52.3

• Uses hledger 1.52.3.

hledger-web 1.52.3

Fixes

• Another XSS (cross-site scripting) vulnerability has been fixed, in
  the add transaction form's error message. Any web page visited while
  hledger-web was running could use it to run javascript in
  hledger-web's origin, and from there read the whole journal, or
  alter it. All hledger-web users should upgrade. See also:
  GHSA-vq7r-8w52-jv84. (Arthur Cinader, Simon Michael, #2700)

• A newline submitted in a transaction's description, code or account
  name is no longer written into the journal file. This removes the
  possibility of the user inserting an include directive, which could
  expose system files readable by the hledger-web server. See also:
  GHSA-vq7r-8w52-jv84. #2704

  Note: as with #2698 in 1.52.2, these fixes were backported from
  AI-assisted fixes in hledger 2, under the security exception in
  https://hledger.org/AI.html; they have been reviewed and tested.

• hledger-web's official binaries, and builds from the hledger source
  tree, now use aeson 2.3, avoiding a denial of service bug.
  (https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html)

credits 1.52.3

Simon Michael,
Arthur Cinader.

For all install options, see hledger.org: Install.
You can install hledger from most package managers (but check for a green badge indicating it's up to date).
Or you can build it from source yourself.

Or you can install up to date binaries from this page, by following the appropriate instructions below.
If you find problems with these instructions, please let us know.

Updates to binaries:

• 2026-01-12: Fixed the hledger-linux-x64.tar.gz asset below, it previously contained a dev build. #2526

If you have eget, that's a convenient way to download the right binaries for your machine:

eget simonmichael/hledger --all

Otherwise:

At the command line:

curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-linux-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

In a terminal window (don't download the binaries with your web browser, they won't get authorised):

On ARM macs:

curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-mac-arm64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

On Intel macs:

curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-mac-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

In a powershell window (press WINDOWS-R, powershell, ENTER):

cd ~
curl https://github.com/simonmichael/hledger/releases/download/1.52.3/hledger-windows-x64.zip -OutFile hledger-windows-x64.zip
Expand-Archive hledger-windows-x64.zip -Force -DestinationPath AppData\Roaming\local\bin
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.3

These instructions have not been tested recently, please let us know if they work for you:

• click hledger-windows-x64.zip below
• choose Open with Windows Explorer, OK
• click Extract all files
• choose a destination folder - ideally one that appears in echo %PATH%, like C:\Windows (though that one will require administrator permission); otherwise, your home directory (C:\Users\YOURNAME)
• check "Show extracted files when complete"
• click Extract, wait for the destination folder to open
• find the hledger, hledger-web icons (if you extracted to \Windows, you'll need to scroll down)
• for each icon: double-click, uncheck "Always ask before opening this file", click Run
• close those Explorer windows
• open a command window (press Windows-r, type CMD, press enter)
• hledger --version; hledger-ui --version; hledger-web --version should show 1.52.3
• echo # >> .hledger.journal to ensure a default journal file exists. (Important: the doubled >> is needed to avoid overwriting existing data.)

Problems:

• Starting hledger by double-clicking its icon won't work because it needs arguments; run it from the command window instead.
• Starting hledger-web by double-clicking its icon may fail eg because Explorer's command window is too small;
  configure that to be larger, or run hledger-web from a command window instead.
• hledger or hledger-web may fail to run if there is not enough memory available.

Next steps

Once installed, run hledger, and perhaps read hledger.org: Quick start.