CVE-2026-41244 - Mojic: Observable Timing Discrepancy in HMAC Verification

Back Back to CVE browser

MEDIUM

Mojic: Observable Timing Discrepancy in HMAC Verification

Published Apr 24, 2026

4.7

MEDIUM

CVSS 3.1

EPSS 0.15%

Description

Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of emojis. Prior to 2.1.4, the CipherEngine uses a standard equality operator (!==) to verify the HMAC-SHA256 integrity seal during the decryption phase. This creates an Observable Timing Discrepancy (CWE-208), allowing a potential attacker to bypass the file integrity check via a timing attack. This vulnerability is fixed in 2.1.4.

Affected products

Vendor Notamitgamer Product Mojic Default
n/a
- Version
  < 2.1.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Notamitgamer

Mojic

n/a

Version	Status	Constraints
< 2.1.4	affected	-

Ecosystem	Package	Introduced	Fixed
npm	mojic	0	2.1.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-208

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25610
Advisory
https://github.com/advisories/GHSA-wqq3-wfmp-v85g
Advisory
https://github.com/notamitgamer/mojic/security/advisories/GHSA-wqq3-wfmp-v85g
exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-41244

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25610		Advisory
https://github.com/advisories/GHSA-wqq3-wfmp-v85g		Advisory
https://github.com/notamitgamer/mojic/security/advisories/GHSA-wqq3-wfmp-v85g		exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-41244