Vulnerability · Published Apr 24, 2026 · Assigned by GitHub_M

CVE-2026-41244Mojic: Observable Timing Discrepancy in HMAC Verification

Medium 4.7

In plain English

A medium-severity security flaw in mojic from notamitgamer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.1%top 98.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of emojis. Prior to 2.1.4, the CipherEngine uses a standard equality operator (!==) to verify the HMAC-SHA256 integrity seal during the decryption phase. This creates an Observable Timing Discrepancy (CWE-208), allowing a potential attacker to bypass the file integrity check via a timing attack. This vulnerability is fixed in 2.1.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	mojic	2.1.4	GHSA-wqq3-wfmp-v85g

Affected products (as reported)

Vendor	Product	Versions
notamitgamer	mojic	< 2.1.4

Weakness: CWE-208 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

References

https://github.com/notamitgamer/mojic/security/advisories/GHSA-wqq3-wfmp-v85g x_refsource_CONFIRM