jekyll/jekyll — pull request #1944 by parkr (2014-01-14 01:27:43+00:00)
Title: Patch show-stopping security vulnerabilities

Two vulnerabilities found:

1. `Post#destination` allows path traversal due to the `CGI.unescape` called prior to the post URL being used in the generation of the output file path. URL escaped characters can be used in a permalink to bypass the filtering provided by `URL#sanitize_url`. (@gregose)

2. Arbitrary file reads via symlinks: it's possible to read anywhere on the filesystem by placing a symlink to a directory in `_includes`. (@charliesome)

GitHub Pages has already been patched. **It is strongly recommended that any other Jekyll hosts upgrade to v1.4.3 when it lands (tonight).**