v5.0.2

knadh/listmonkv5.0.2Jun 8, 2025by github-actions[bot]

AI Summary

Security-focused release that disables dangerous Sprig template functions (env and expandenv) to prevent unprivileged users from accessing environment variables. Also includes bug fixes for translation and subscriber status issues.

Key Highlights

Security fix: Disable dangerous env and expandenv Sprig template functions
Fix Vietnamese translation issues
Fix subscriber unsubscription status being reset to confirmed on save
Update simples3 to latest version

New Features

Disabled env and expandenv template functions
Vietnamese translation fix
Subscriber status fix
S3 library update

Full Release Notes

[![listmonk-logo](https://user-images.githubusercontent.com/547147/134940003-1de03d83-8c7b-459b-8056-baa8d5f3b448.png)](https://listmonk.app)

v5.0.2 contains an important security update which disables the `env` and `expandenv` [Sprig](https://masterminds.github.io/sprig/) template functions preventing accessing of env variables from templates. This affects v4.0.0 - v5.0.1 installations that have unprivileged users in a multi-user setup.

## How to upgrade
**As always, take a backup of your database before upgrading.**

**Binary**

Download the latest binary. Stop and replace the old binary. Run `./listmonk --upgrade`. Start the app again.

**Docker**
```shell
# cd /directory/with/docker-compose.yml

docker-compose down
docker-compose pull && docker-compose run --rm app ./listmonk --upgrade
docker-compose up -d app db
```

 


## Changelog
* d27d2c32 Remove dangerous tpl funcs in Sprig that's enabled by default.
* 6fc6c1ec Fix Vietnamese translation issues (#2487)
* d6f5292d Fix subscribers unsubscription status being reset to confirmed on save (#2517)
* 8b8358e9 Add Nodion Deployment Option (#2518)
* 3f395085 updates simples3 to latest version (#2520)
* d027cb5d Add kloudbean hosting link to static website (#2508)
* bf502ba7 Update release details on the static homepage.