# HedgeDoc 1.11.0 — HedgeDoc 1.11.0

- Product: HedgeDoc (https://whatsnew.fyi/product/hedgedoc)
- Vendor: HedgeDoc
- Date: 2026-06-18
- Version: 1.11.0
- Original notes: https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.0
- Permalink: https://whatsnew.fyi/product/hedgedoc/releases/1.11.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fix possible HTML injection via the localpart of an email address
- **security** — Fix possible Denial-of-Service attack using the YAML frontmatter parsing
- **security** — Fix possible CSRF attack vector in the GitHub Gist export
- **security** — Fix rate-limiting bypass by abusing the CF-Connecting-IP header
- **added** — Add a warning page when clicking external links
- **added** — Allow configuration of login and signup rate-limits
- **added** — Allow configuration of Cloudflare usage in regards of rate-limits
- **changed** — Improve the config.json.example file used by bin/setup

###### Security fixes

This release contains four security fixes:
- [GHSA-6c2w-8w96-3pcv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6c2w-8w96-3pcv) reports a possible HTML injection via the localpart of an email address.
- [GHSA-qj78-mjch-wwrv](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-qj78-mjch-wwrv) reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
- [GHSA-8v9p-5j95-826j](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-8v9p-5j95-826j) reports a possible CSRF attack vector in the GitHub Gist export.
- [GHSA-2f9f-w8xq-276v](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v) reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to [Chandler Johnson](https://github.com/chndlrx), [taylorodell](https://github.com/taylorodell) and [alanturing881](https://github.com/alanturing881) for reporting!

###### Important notices

- When using Cloudflare in front of HedgeDoc, you should set `rateLimitUsingCloudflare` in the config.json or `CMD_RATE_LIMIT_USING_CLOUDFLARE` as environment variable to `true`.

###### Enhancements

- Added a warning page when clicking external links
- Improve the config.json.example file, which is used by `bin/setup`
- Allow configuration of login / signup rate-limits
- Allow configuration of Cloudflare usage in regards of rate-limits
- Several improvements in the documentation at <https://docs.hedgedoc.org>