Vintage Story Config Lib: Which Versions Are Safe

Vintage Story Config Lib: Which Versions Are Safe

Vintage Story itself is not affected. The game, the dedicated server and the official 1.22 builds are clean. This page is about a single mod: Config Lib, which shipped hidden code that deliberately crashes the game client under certain conditions.

Config Lib matters more than a typical mod because it is a dependency. It has over 650,000 downloads and many other mods require it, so plenty of people have it installed without ever choosing it.

What the code actually did

Config Lib contained code that checks which other mods are loaded and crashes your client if it finds ones the mod's author objected to. The stated target was mods the author considered cheating, but the trigger list also caught unrelated mods, including one that adds a radio to the game.

Two things are worth being precise about, because the word "malware" is doing a lot of work in the community discussion:

• It is sabotage, not theft. The reported behaviour is crashing the game client. There is no public evidence of credential theft, file exfiltration, or anything reaching outside the game.
• It targeted clients, not servers. The crash happens on the player's machine, based on the mods that machine has loaded. A dedicated server with Config Lib in its mod folder is not itself being attacked.

That second point is why this still matters to server owners: on a modded Vintage Story server, players are expected to run the same mod set as the server. If your server requires Config Lib, your players are running it too.

Version status

Taken from the release table on the official mod database, which marks retracted releases explicitly:

A retraction on the mod database is the author or a moderator pulling a release. It is the clearest public signal available of which builds are implicated, which is why this page uses it rather than trying to interpret the source code. Match the mod to your game version: the 1.13.x releases will not load on a 1.21 server, so "update to 1.13.2" is only correct advice on 1.22. Check the version file on your server, or the game version shown in the panel, before choosing.

How to check your server

Mods live in the Mods folder inside your server's data directory. Look for a file named configlib_<version>.zip and read the version from the filename.

ls data/Mods/ | grep -iE '^configlib_'

The pattern is anchored to the start of the filename on purpose; a loose match also catches the unrelated Auto Config Lib, covered next.

If you use our file manager or FTP, the same folder is browsable directly. See installing mods on a Vintage Story server for where that folder sits.

Do not confuse it with Auto Config Lib

autoconfiglib is a different mod, by a different author, and is not the compromised one. A loose search for "configlib" matches both. But do not read its presence as "nothing to do": Auto Config Lib requires Config Lib, so a server that has Auto Config Lib almost certainly has Config Lib installed alongside it. Auto Config Lib itself needs no update; the Config Lib next to it is what to check.

What to do

1. Update Config Lib to the newest clean build for your game version. On Vintage Story 1.22 that is 1.13.2 from the official mod database. On 1.21 there is no clean build newer than 1.10.7, so either update the game to 1.22 first or remove the mod. Anything on the 1.10.8 to 1.13.0 range should move.
2. Tell your players. They need the same version you do. A client still on an affected build can crash on your server even after you update, and it will look like a server fault.
3. Back up before changing mods. Standard practice for any mod change on a live world. See save management.
4. Restart the server so the new version loads. See updating a server safely.
5. If a mod pulled Config Lib in as a dependency, check whether that mod still needs it, and whether its author has responded. Removing a dependency other mods rely on will break them.

Frequently asked

Is Vintage Story itself compromised?

No. This is one community mod. The game, the dedicated server, and official builds are unaffected. Headlines naming the game rather than the mod have caused avoidable alarm.

Was anything stolen from my machine?

There is no public evidence of data theft. The reported behaviour is a deliberate client crash under specific mod combinations. If you want certainty for your own machine, that is a question for the mod's source, not for a hosting guide.

Does my server need to be wiped or reinstalled?

No. Nothing here describes server-side damage, world corruption, or persistence. Updating the mod and restarting is the whole action.

I run a vanilla server. Am I affected?

No. Config Lib is a mod. If your Mods folder does not contain it, there is nothing to do.

Is 1.13.2 safe?

It is the current release, it is not retracted, and the 1.13.1 changelog states the code was removed. That is the best assurance publicly available. It is built for Vintage Story 1.22; it is not an option on a 1.21 server. If you would rather not rely on it, the alternative is removing Config Lib and the mods that depend on it.

My server is on Vintage Story 1.21. What do I do?

The 1.13.x releases will not load on 1.21. The newest release that is not retracted for 1.21 is 1.10.7, which predates the code. Moving to it means staying on an old mod build, so the cleaner path is updating the game to 1.22 and then installing 1.13.2. See updating your server version safely.

Related pages

• Installing mods on a Vintage Story server
• Fixing the server mod sync loop
• Best Vintage Story mods 2026
• Save management and backups
• Updating your server version safely
• Mod save corruption during an update

Running a modded Vintage Story world on a managed Vintage Story server means scheduled backups are already in place before you change a mod, so a bad mod update is a restore rather than a lost world.