CVE-2025-65570

critical · 9.8

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.

9.8

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2025-12-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-843

Affected products

Vendor	Product	Affected versions
jsish	jsish	2.0

Check a specific version with /api/v1/cve/match.

References

https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html
https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-65570