Repository navigation
web: newlines in submitted transactions could write directives into the journal file #2704
Description
hledger-web could write a newline submitted in a transaction field into the journal file, allowing the user to inject an include directive and (attempt to) include other system files readable by hledger-web.
Fixed on main and on 1.52-branch, to be released in 1.52.3. Details in the security advisory published with that release.
Activity
fix:web: collapse newlines in submitted transactions [#2704]
fix:web: collapse newlines in submitted transactions [#2704]
fix:web: collapse newlines in submitted transactions [#2704]
simonmichael commentedon Aug 27, 2026
Fixed in 1.52.3 and main.
fix:web: collapse newlines in submitted transactions [#2704]
;doc: add 1.52.2 and 1.52.3 changelogs and relnotes
!17884 merge bump-hledger-1.52.3 into main