---
id: CVE-2025-65570
title: >-
  A type confusion in jsish 2.0 allows incorrect control flow during execution
  of the OP_NEXT opcode
summary: >-
  A type confusion in jsish 2.0 allows incorrect control flow during execution
  of the OP_NEXT opcode. When an “instanceof” expression uses an array element
  access as the left-hand operand inside a for-in loop, the instructions
  implementati…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-843
vendor: jsish
product: jsish
affected:
  - jsish = 2.0
published: '2025-12-29'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65570'
references:
  - url: 'https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html'
    label: cve@mitre.org
  - url: 'https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00528
epssPercentile: 0.4306
ingestedAt: '2026-10-13T09:20:23.169Z'
---

## Overview

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.

## Affected

- `jsish = 2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.