Mojic, a command‑line tool that converts C source into a stream of emojis, verifies file integrity by comparing an HMAC‑SHA256 seal during decryption. In versions prior to 2.1.4 the comparison uses a standard equality operator (!==), which results in a measurable timing discrepancy (CWE‑208). This side‑channel can be exploited to gain knowledge about the HMAC value and ultimately allow an attacker to bypass the integrity check, letting forged files be processed as if they were authentic.

The vulnerability affects the Mojic CLI distributed by the notamitgamer project, specifically all releases older than 2.1.4. Users who continue to run these earlier versions are subject to the risk until they upgrade.

The CVSS score of 4.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply crafted inputs to the decryption routine and measure timing differences, which is more feasible in environments where the CLI is exposed to untrusted data or where an attacker can read the tool’s timing output. Because no remote code execution or privilege escalation is achieved, the impact is limited to compromising file authenticity.