CVE-2025-65570

When the 'instanceof' expression uses array element access as the left-hand operand within a for-in loop, the OP_INSTANCEOF opcode implementation leaves an additional reference to the array on the stack instead of consuming it. Subsequently, the OP_NEXT opcode incorrectly interprets this array as an iterator object and reads the iterCmd function pointer from an incorrect structure. This leads to a situation where the interpreter operates on data with an incorrect type (CWE-843: type confusion), which opens the possibility of controlled control flow hijacking.

An attacker can cause the interpreter to crash or — depending on the heap layout — execute arbitrary code with the privileges of the process running Jsish. The complete CIA triad is at risk (confidentiality, integrity, availability).

Apply patches available from the vendor according to the references. Until a patch is released, it is recommended to avoid running untrusted JavaScript code in the Jsish 2.0 environment and restrict access to the interpreter only to trusted users.

Jsish version 2.0