This is the current version. · Released:
Installer files 1.7.3
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | EXE (Inno Setup) · en-US | All users | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
- fixed command injection with custom link actions (@r3vpwnx, @Afnaan-Ahmed #2945 CVE-2026-118692)
- fixed arbitrary local file read via crafted embedded-file name (@Afnaan-Ahmed, #2944 CVE-2026-118693)
- reject symlinked multifile node directories + prevent cleanup from following symlinks (@acts-1631, #2922, #2920)
- reject empty tables during XML parsing so malformed XML cannot reach table construction or clipboard indexing (@acts-1631, #2923)
- on node name header, show node icon and aux icons on the left rather than on the right, just after last visited nodes buttons
- improved image download on HTML paste from browser (#2925)
- fixed crash when destroying anchored widgets (#2947)
- support for new language Tamil (@TamilNeram)
- build with libxml++5 on windows/msys2, ubuntu 26.04+, flatpak (#2918, @bgermann)
