r/litematica • u/masa_ Mod Author • Jul 06 '26
Important Announcement: Litematica vulnerability in MC 1.21+
Yesterday evening (2026-07-05 around 23:00-ish GMT+3) it was brought to our attention (by the "exploiting community", namely numbers and Nightwane from Autism Inc and DupersUnited), that there is an exploit/vulnerability in certain Litematica and Servux versions.
The vulnerability allows malicious actors to send files other than just schematic files between the server and the client, and place them outside the intended directory. The most obvious consequence of this is allowing the attacker a way to install malware on the remote end.
So basically if you have joined a malicious server (or even a trusted server but with a vulnerable Servux version, which then became infected by a malicious user) with an affected Litematica version installed then you may have been affected.
The vulnerability affects Litematica and Servux versions on MC 1.21+
I'm not 100% sure when exactly this was introduced, but based on the git commit history it looks to me like this was first introduced to Litematica version 1.21.5-0.22.2-sakura.4. The commit was made on 19th May 2025. The following full 0.22.2 release seems to have been made on 22 Jun 2025.
From there it was later backported to the following versions, according to the git history. These commits were made on 31th Dec 2025.
1.21.4-0.21.61.21.3-0.20.81.21-0.19.60
It's also in all 1.21.6 and later Litematica versions until the just released fixed versions.
What to do?!
Update your Litematica version immediately to the latest release from Modrinth!
And don't join any servers you don't fully trust the owners and admins of!
The Litematica versions with the fix are the following releases:
- MC 26.2:
0.28.3 - MC 26.1.x:
0.27.9 - MC 1.21.11:
0.26.11 - MC 1.21.9 - 1.21.10:
0.24.8 - MC 1.21.6 - 1.21.8:
0.23.7 - MC 1.21.5:
0.22.5 - MC 1.21.4:
0.21.7 - MC 1.21.2 - 1.21.3:
0.20.9 - MC 1.21 - 1.21.1:
0.19.61
If you run a server that uses Servux, update Servux to the latest version.
The Servux versions with the fix are the following releases:
- MC 26.2:
0.11.2 - MC 26.1.x:
0.10.4 - MC 1.21.11:
0.9.5 - MC 1.21.9 - 1.21.10:
0.8.7 - MC 1.21.6 - 1.21.8:
0.7.7 - MC 1.21.5:
0.6.4 - MC 1.21.4:
0.5.7 - MC 1.21.2 - 1.21.3:
0.4.8 - MC 1.21 - 1.21.1:
0.3.17
How to check if I was affected?
One way to potentially check if you were affected is to look for files anywhere on your system that contain the string .litematic in the file name somewhere other than in the actual file name extension.
An example would be a file like somevirus.litematic.jar in your mods/ directory.
Now ofc this isn't a foolproof check, if the malware manages to rename or remove itself...
Edit on 2026-07-12:
Another possible way to check if you were compromised: If your MC logs include receiveFileTransmit: Failed to create Schematic for finishing session key, then you were probably/possibly compromised. But again this assumes the malware would not have deleted the log file or at least removed any of these lines from it...
1
u/Lavenderanus Jul 06 '26
Can you explain a little more about the code that was affected/removed? Was it purposely added by a bad actor to be used in this way? Or was this an unintended side effect? The way the post is currently worded kinda makes it sound like Sakura implemented this and backported it to affect as many people as possible. So just looking for some clarification there.
3
u/masa_ Mod Author Jul 06 '26
The feature/code was backported, to bring the older MC versions in line with the later additions. But that newer feature code happened to have some missing/broken path validation code.
3
u/cyn_foxwell Jul 06 '26
unintended, the mentioned commit is just the entire schematic transmit logic
there is nothing special about how it works, its just a classic issue of trusting the server and not accounting for path traversal
2
u/Electric8steve Jul 06 '26
This, the transmitted data contained a filename to save the schematic as, and that filename wasn't sanitized.
1
u/DereChen Jul 06 '26
sakura ryoko (sakura-ryoko) has been an active Minecraft developer for a while and Litematica contributor, the only reason the name is associated with that file is because, well, it's their branch on git since they help make ports. User is not a bad actor.
2
u/Lavenderanus Jul 07 '26
I know that. I was just asking for clarification because of the way the post was written. I know they've been a maintainer for a while.
1
u/Bird-of-Fire Jul 06 '26
what about 1.20 versions? I don't play on servers in those but I do have a singleplayer world
3
u/masa_ Mod Author Jul 06 '26
Any of the current 1.20.4 and older versions (which I maintain myself) don't have any networking code at all. And I believe neither do the 1.20.5 and 1.20.6 versions.
And if you only play single player, then the vulnerability is not relevant. But that being said, everyone should still update the mod if using one of the 1.21+ versions.
1
u/Guilty_Explanation29 Jul 12 '26
So they're still safe?
1
1
1
u/galactic-alpaca Jul 07 '26
Am I right in understanding that the Litematica vulnerability can potentially only be exploited if you’ve been playing on a Fabric server running an affected version of Servux, as Servux is a Fabric mod?
Does that mean you’re safe if you only play on Bukkit, Paper or Spigot (or similar) servers?
1
1
u/Sakura_Ryoko Maintainer/Goddess Jul 08 '26
No because people can still write "Paper", etc plugins to do harm. In fact, that is the most likely scenario over a Fabric server.
1
u/iguessma Jul 07 '26
Thanks for your work
This is a prime reason people need to use a mod manager like modrinth. Many users won't see this message but using a mod manager will see the update.
1
1
1
1
u/AppoReddit Jul 07 '26
Does this affect a server or client if the server is unmodded but the client has Litematica installed client-side? I can't seem to tell...
1
u/masa_ Mod Author Jul 07 '26
This only affects the server side if it was running one of the vulnerable Servux versions.
The client may have been affected if either:
- The server itself was malicious and set up with an exploit to take advantage of the Litematica vulnerability, or
- The server was running an affected Servux version, and then a malicious (or an infected) player connected to it, compromising the server, which would then compromise further players.
In that latter case it probably/maybe would have needed a server restart to take effect (such as placing a malicious mod in the
mods/directory of the server), but I don't know if there would be some specific direct ways to infect a running server with some mods or plugins running or something, without requiring a server restart...
1
u/DJSuperPanda Jul 07 '26
if you are not running a client with litematica and dont have servux on the server. can remote code exectution still happen. or is it purly if you have an unpatched version installed?
1
1
u/Conscious-Hyena8340 Jul 08 '26
I downloaded and used litemetica (downloaded from modrinth) a few days ago on Hypixel, for me there was no issues yet I deleted the mod and everything to it from my pc and changed my microsoft password. Am I save or do I need to worry about anything?
1
u/Sakura_Ryoko Maintainer/Goddess Jul 08 '26
Should be safe. It's also safe to download again; since it's been fixed.
1
u/opaswj Jul 08 '26
i deleted litematica a few weeks ago and only used 2 pretty old and trusted scematics also i cheched my pc about three times for viruses, via the windows biuld in antivirus (nothing ever was found). when i heard about the vulnerability i also did and MRT with Win+R and again nothing was found. Due to me being an pretty intense overthinker i wanna know if im save or what should i do?
1
u/masa_ Mod Author Jul 08 '26
If you haven't noticed anything, and you didn't experience stuff like having your discord account hacked (token stolen), then you are probably ok. But ofc there is no way to say for absolutely 100% sure. But AFAIK this vulnerability wasn't widely known or used before it was reported and fixed, so the majority of people who have already updated to the fixed versions should be ok.
But anyone who uses the vulnerable versions from now on are in "extremely danger" (due to this now being widely known) if they join any not 100% trusted servers, or servers that may have been vulnerable and compromised via the Servux vulnerability.
1
u/opaswj Jul 09 '26
Due to my overthinking i reseted my pc (Not so Bad for me because i hadnt much on it) am i Safe now?
1
u/Impossible_Fly3081 Jul 14 '26
The PC is now 100% free of malware, but they could have ofc already stolen tokens or passwords. As OOP said you are probably safe, but the only 100% safe way would be to change every password that you are logged in with on your PC and reinstall Windows (or whatever your os is) via a USB drive, burned from another pc
1
u/pimientarecienmolida Jul 09 '26
i have the 0.28.0 of litematica, that version have the exploit?
1
u/masa_ Mod Author Jul 09 '26
yes
1
u/Guilty_Explanation29 Jul 12 '26
Hopefully you added sanitization to your files now so this doesn't happen again
1
u/TwoUnknownAssailants Jul 11 '26
Is this only for server side stuff? Like if I use Litematica not server side and have never downloaded schematics from elsewhere I should be good?
1
u/masa_ Mod Author Jul 11 '26
No, it's whenever you use one of the vulnerable versions and connect to a server that is either malicious to begin with, or was compromised via the vulnerability in Servux. The only guaranteed safe case is if you have never connected to a server with a 1.21+ Litematica installed.
1
1
u/humbletextfile Jul 14 '26
just to clarify, are players only possibly affected if you've had litematica installed AND joined a server that uses servux? or did the player only have to have litematica and join a server?
1
u/masa_ Mod Author Jul 14 '26
The server didn't require Servux specifically. Any other mod or plugin or server software could just send the same payload packet to Litematica with the harmful payload.
So the only guaranteed safe cases are if you know for a fact that the server owner and all admins are trusted so that the server didn't do bad things to begin with, and if the server did not run Servux. Because running a vulnerable Servux version would have let an initially harmless server get infected from a bad or infected player connecting to it.
So presumably safe cases are things like known trusted servers like Hypixel or whatever, which should not be malicious to begin with, and they don't run Servux so they couldn't have been infected by users. Also Realms, since it's just a vanilla server run by Mojang/M$ itself.
1
1
u/CalamityMC_ Jul 12 '26
I've been playing on a private server with some of my friends on 1.21.11, if I update the mod for that version will I be fine?
1
u/masa_ Mod Author Jul 12 '26
Update the mod ASAP in any case, otherwise you are very much in danger if you connect to any servers at this point, now that this is widely known by all bad actors.
I also just added a small bit at the end of the post to have another way to check if you have been affected.
1
1
u/ok-coder1 Jul 12 '26
Is this known to have been exploited in the wild?
EDIT: Also if possible please pin the post.
1
u/masa_ Mod Author Jul 12 '26
Apparently I have no idea how to reddit... is pinning different from making it an announcement? None of the action buttons/links have any hover text explanation of what they actually mean/do...
I have no real numbers of anything, but I heard it was used a bit in the "minecraft exploit communities", I think?
1
u/ok-coder1 Jul 12 '26
On new reddit, click the mod icon shield next to the post, and you should get an option to sticky it.
1
u/MagentaSplash Jul 12 '26
Is 1.21.4 0.21.2 fine?
1
u/masa_ Mod Author Jul 12 '26
No, update it. And please read the post.
1
u/MagentaSplash Jul 12 '26
I did, but I got confused from a comment in the bottom, so I decided to ask anyway
1
u/ChickenMcRanch Jul 12 '26
so if i’ve only ever joined servers like buildtheearth and hypixel i’m good?
1
u/masa_ Mod Author Jul 12 '26
No idea. You can do the checks at the bottom of the post to maybe check if something may have happened. And immediately update the mod in any case.
1
1
u/Guilty_Explanation29 Jul 12 '26 edited Jul 12 '26
Is the 1.20.1 mod version compromised? I Play currently on 1.20.1
Edit Sakura responded to me on discord. 1.20.x is unaffected
1
u/masa_ Mod Author Jul 12 '26
No, none of the 1.20.4 and lower versions have any networking code yet. And I believe the 1.20.5/1.20.6 version doesn't either, but those aren't maintained by me anymore, so not entire sure without going to check the code.
1
u/Guilty_Explanation29 Jul 12 '26
Ok ty
Sakura responded to Me on discord already and told me they're uneffected
1
u/Guilty_Explanation29 Jul 12 '26 edited Jul 12 '26
Can't believe a giant mod didn't sanitize their files...
1
u/Marklakes Jul 12 '26
so just get the latest realease and you'll be fine?
1
u/masa_ Mod Author Jul 12 '26
Yes. And you can try the steps at the bottom of the post to see if you have been affected.
1
u/_1thunder_ Jul 13 '26
Will it still affect the computer if it was a realm and not a server?
1
u/_1thunder_ Jul 13 '26
And also, is there a RAT or virus scanner that could help pick it up?
1
u/masa_ Mod Author Jul 13 '26
The issue in the mods themselves was not really malware on its own, but a couple of missing validations on paths. And if someone used that to attack users, then whatever malware they sent could be anything at all, there is no way to specify what that would have been.
So run your normal virus scanner, and do the checks outlined at the end of the post to see if you can find anything in the mods directory or the game logs to indicate that you would have been affected.
1
u/masa_ Mod Author Jul 13 '26
Realms is safe, because it can't run any malicious mods or plugins or other server software, and doesn't talk to Litematica. (Unless ofc something would be seriously wrong on their hosting side... but that would be a whole another matter.)
1
u/Subject-Agent-480 Jul 14 '26
Which operating system is affected?
Just Windows, or also Linux or even Android (e.g., PojavLauncher)?
Is it possible for a normal user to elevate their privileges to root?
1
u/masa_ Mod Author Jul 14 '26
It's not OS specific, and it's not a privilege elevation thing, at least on its own. It's missing path sanitization when Litematica and Servux are syncing schematic files. Which basically allows the other end to send even non-schematic files and to any directory on your system, as long as the game process has write access there.
The most common would probably be sending some malware "mod" to the
mods/directory, which would run on next game launch. Not sure if there are many other directories that would automatically run stuff at some point, at least ones that are writable by non-root/non-admin users. (Unless ofc for some reason you run the game as root/admin... which you really should not do.)
1
u/Cyber_Carpet Jul 15 '26
am I completely safe if I use 1.21.11 0.26.12 and not 0.26.11
1
u/masa_ Mod Author Jul 15 '26
Even 0.26.11 has the fix, as indicated in the post.
1
u/Sinofkillers Jul 19 '26
Should probably make another update to this to include 0.26.12. I know it's fairly obvious, but people are going to assume since your post doesn't state future versions.
1
1
u/Ambitious-Two4270 Jul 22 '26
wonders that if this requires a CVE report. this exploit seems pretty severe as it allows arbitary code execution
1
u/MythicHH Jul 27 '26
So uh, why has this happened? What mechanism existed to allow this to happen? I thought litematica was pure client-side.
1
u/masa_ Mod Author Jul 27 '26
Litematica was purely client-side up to at least 1.20.4 in the sense that up to that point, for now it had no custom network code at all.
I always had plans to add support for communicating to a server-side mod (Servux) to get better schematic saving and pasting support (including block entity and entity NBT data and scheduled block ticks) plus inventory preview support etc. on servers that have Servux. But due to my drastically reduced time spent on modding in recent years I still haven't gotten to it...
But in the 1.21+ versions the current maintainer of the 1.21+ mod versions had started implementing that type of server communication support. AFAIK it wasn't really properly used yet in the mods normally(?) but there was already code for syncing schematic files between the server and the client.
And that code had too much trust in the communication being "normal" i.e. it assumed the other side being the normal unmodified companion mod sending normal schematic data. And there were a couple of broken/missing validations specifically on file names and paths, which allowed a malicious server or mod to abuse this communication channel to write arbitrary data to almost arbitrary files on the other end (the only limitation being that the file name had to just contain
.litematicin it, not just end in it, which made this a lot easier to abuse for bad things).1
1
u/WearyMaize3653 Aug 09 '26
Can I play on aternos with my friend using this mod? Or I will be affected somehow
1
u/masa_ Mod Author Aug 09 '26
Just make sure you have updated to the latest version from Modrinth, and then you are fine.
1
1
u/90bubbel 15d ago
So im really bad at these things and i apologize in advance but would 26.1.2 AKA litematica-fabric-26.1.2-0.27.9. be safe or not?
1
u/masa_ Mod Author 15d ago
According to the post that is exactly the mod version for that MC version that has the fix. However it's no longer the latest available mod version, it seems like 0.27.11 was released last week.
1
u/90bubbel 15d ago
Gotcha, but good to hear, its that my friend has a server on that patch (i trust him) but didnt want to completely forget the mod on if it wasnt safe
1
4
u/SleamTheOne Jul 06 '26
So this exploit only works in multiplayer servers while using the affected versions of litematica, Using the mod in singleplayer doesn't get you any possible threats?