diff --git a/.gitignore b/.gitignore
index 86fe057..996b16d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@ workrave-1.9.1.tar.gz
 /workrave-v1_10_50.tar.gz
 /workrave-v1_10_51_1.tar.gz
 /workrave-v1_10_52.tar.gz
+/workrave-v1_10_53.tar.gz
diff --git a/0001-Fix-CVE-2023-2142.patch b/0001-Fix-CVE-2023-2142.patch
new file mode 100644
index 0000000..4253843
--- /dev/null
+++ b/0001-Fix-CVE-2023-2142.patch
@@ -0,0 +1,40 @@
+From 2b8e45a2b9763866f708081ce91c97a21d2757e1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C5=81ukasz=20Wojni=C5=82owicz?=
+ <lukasz.wojnilowicz@gmail.com>
+Date: Sun, 20 Apr 2025 09:30:04 +0200
+Subject: [PATCH] Fix CVE-2023-2142
+
+---
+ build/newsgen/package-lock.json | 2 +-
+ build/newsgen/package.json      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/build/newsgen/package-lock.json b/build/newsgen/package-lock.json
+index fcdedc15..88b19c3c 100644
+--- a/build/newsgen/package-lock.json
++++ b/build/newsgen/package-lock.json
+@@ -12,7 +12,7 @@
+                 "async": "^3.2.0",
+                 "js-yaml": "^3.14.0",
+                 "moment": "^2.27.0",
+-                "nunjucks": "^3.2.2",
++                "nunjucks": "^3.2.4",
+                 "remark-parse": "^9.0.0",
+                 "to-vfile": "^6.1.0",
+                 "unherit": "^1.1.3",
+diff --git a/build/newsgen/package.json b/build/newsgen/package.json
+index f55b0ebe..af9c02c9 100644
+--- a/build/newsgen/package.json
++++ b/build/newsgen/package.json
+@@ -13,7 +13,7 @@
+         "async": "^3.2.0",
+         "js-yaml": "^3.14.0",
+         "moment": "^2.27.0",
+-        "nunjucks": "^3.2.2",
++        "nunjucks": "^3.2.4",
+         "remark-parse": "^9.0.0",
+         "to-vfile": "^6.1.0",
+         "unherit": "^1.1.3",
+-- 
+2.49.0
+
diff --git a/sources b/sources
index 3527af4..1f3b379 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (workrave-v1_10_52.tar.gz) = 4e64e4ef3bbf11e397af6c8086265ab4a628d05648e3662651d25079299e3016bd97c186fc069621121ab889ee22a1c58793fe81fc7fe4b6e4e1ebc7575993e8
+SHA512 (workrave-v1_10_53.tar.gz) = bda509188ce2bf3e8ddb9d92d42fbf16b299325086691cf8978a137e7d194e33695f84efc9a3fe1228e034cb54abd28fed975a13823695b8d24f10bf9be850de
diff --git a/workrave.spec b/workrave.spec
index b40ddd5..6104863 100644
--- a/workrave.spec
+++ b/workrave.spec
@@ -15,7 +15,7 @@
 %endif
 
 Name:          workrave
-Version:       1.10.52
+Version:       1.10.53
 Release:       %autorelease
 Summary:       Program that assists in the recovery and prevention of RSI
 # Based on older packages by Dag Wieers <dag@wieers.com> and Steve Ratcliffe
@@ -23,6 +23,8 @@ License:       GPL-3.0-or-later AND LGPL-2.0-or-later
 URL:           https://workrave.org/
 %global tag %(echo %{version} | sed -e 's/\\./_/g')
 Source0:       https://github.com/rcaelers/workrave/archive/v%{tag}/%{name}-v%{tag}.tar.gz
+# https://bugzilla.redhat.com/show_bug.cgi?id=2328913
+Patch:         0001-Fix-CVE-2023-2142.patch
 
 Obsoletes:     %{name}-gtk2 < 1.10.37-1
 Provides:      %{name}-gtk2 = %{?epoch:%{epoch}:}%{version}-%{release}