We’re pleased to announce Greenshot 1.3.328, a focused security and bug-fix update for the 1.3 series. Download it now from our official download page.

🔒 Security Fixes

Earlier Greenshot 1.3 builds could send Windows NTLM/Negotiate credentials when requesting a URL on an untrusted host. This release stops attaching Windows credentials to requests sent directly to arbitrary servers, closing that path. Thanks to @Y4k150b4 for reporting the issue and @Lakritzator (Robin Krom) and @jklingen for the fix (release commit). See the GHSA-gjcr-pccx-w2vg security advisory for details.

🛠️ Improvements & Fixes

We also fixed a crash that could occur when Windows wouldn’t create the toast notifier. Greenshot now skips the unavailable notification and keeps running (PR #1515).

All shipped executables and DLLs are now signed, so Smart App Control no longer blocks them (PR #1505, thanks to @Lakritzator and @jklingen).

🔮 What’s Next

This is a maintenance update for Greenshot 1.3 users while work on Greenshot 1.4 continues.

Thanks to the contributors

Thanks to @Y4k150b4 for responsibly reporting the security issue, @Lakritzator (Robin Krom) and @jklingen for the security fix, and @Lakritzator for fixing the toast-notifier crash.

For the full list of changes, see the Greenshot 1.3.328 changelog.