simonmichael/hledger 1.52.2

on GitHub

hledger 1.52.2

• Uses hledger-lib 1.52.2.

hledger-ui 1.52.2

• Uses hledger 1.52.2.

hledger-web 1.52.2

Fixes

• An XSS (cross-site scripting) vulnerability has been fixed in the add
  transaction form's autocomplete. Journal data from an untrusted source
  could execute javascript when shown as a completion suggestion. All
  hledger-web users are encouraged to upgrade. Full technical details:
  GHSA-538p-cvc4-4qjm.
  (Arthur Cinader, Simon Michael, #2698)

  Note: this bug was detected, and the original patch was generated, by
  Arthur Cinader with AI assistance, for hledger 2.x. Because the
  vulnerability is in theory quite severe, and the fix is small and
  obvious, and I don't want to add risk by redoing it from memory, and
  no-one else volunteered promptly to do that work - and after
  discussion in the chat and mail list (see today's thread), and careful
  human review and testing - I manually backported the same fix to
  hledger 1. And, updated the project's https://hledger.org/AI.html
  policy to allow this for needed security-related fixes like this one
  (which I expect to be very rare).

credits 1.52.2

Simon Michael,
Arthur Cinader.

For all install options, see hledger.org: Install.
You can install hledger from most package managers (but check for a green badge indicating it's up to date).
Or you can build it from source yourself.

Or you can install up to date binaries from this page, by following the appropriate instructions below.
If you find problems with these instructions, please let us know.

Updates to binaries:

• 2026-01-12: Fixed the hledger-linux-x64.tar.gz asset below, it previously contained a dev build. #2526

If you have eget, that's a convenient way to download the right binaries for your machine:

eget simonmichael/hledger --all

Otherwise:

At the command line:

curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.2/hledger-linux-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.2

In a terminal window (don't download the binaries with your web browser, they won't get authorised):

On ARM macs:

curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.2/hledger-mac-arm64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.2

On Intel macs:

curl -fLOC- https://github.com/simonmichael/hledger/releases/download/1.52.2/hledger-mac-x64.tar.gz | tar -xzv -f- -C/usr/local/bin hledger hledger-ui hledger-web
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.2

In a powershell window (press WINDOWS-R, powershell, ENTER):

cd ~
curl https://github.com/simonmichael/hledger/releases/download/1.52.2/hledger-windows-x64.zip -OutFile hledger-windows-x64.zip
Expand-Archive hledger-windows-x64.zip -Force -DestinationPath AppData\Roaming\local\bin
hledger --version; hledger-ui --version; hledger-web --version    # should show 1.52.2

These instructions have not been tested recently, please let us know if they work for you:

• click hledger-windows-x64.zip below
• choose Open with Windows Explorer, OK
• click Extract all files
• choose a destination folder - ideally one that appears in echo %PATH%, like C:\Windows (though that one will require administrator permission); otherwise, your home directory (C:\Users\YOURNAME)
• check "Show extracted files when complete"
• click Extract, wait for the destination folder to open
• find the hledger, hledger-web icons (if you extracted to \Windows, you'll need to scroll down)
• for each icon: double-click, uncheck "Always ask before opening this file", click Run
• close those Explorer windows
• open a command window (press Windows-r, type CMD, press enter)
• hledger --version; hledger-ui --version; hledger-web --version should show 1.52.2
• echo # >> .hledger.journal to ensure a default journal file exists. (Important: the doubled >> is needed to avoid overwriting existing data.)

Problems:

• Starting hledger by double-clicking its icon won't work because it needs arguments; run it from the command window instead.
• Starting hledger-web by double-clicking its icon may fail eg because Explorer's command window is too small;
  configure that to be larger, or run hledger-web from a command window instead.
• hledger or hledger-web may fail to run if there is not enough memory available.

Next steps

Once installed, run hledger, and perhaps read hledger.org: Quick start.