PT-2025-53725 · Git+1 · Jsish

Mcsky · Published 2025-12-29 · Updated 2025-12-29 · CVE-2025-65570

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jsish version 2.0

Description A type confusion occurs during the execution of the OP NEXT opcode. This happens when an "instanceof" expression uses an array element access as the left-hand operand within a for-in loop, causing the implementation to leave an extra array reference on the stack instead of consuming it during OP INSTANCEOF. Consequently, OP NEXT treats the array as an iterator object and reads the iterCmd function pointer from an invalid structure, which may lead to a crash or arbitrary code execution depending on the heap layout.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2025-65570

Affected Products

Jsish

References · 3

• 🔥 https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65570 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65570 · Vendor Advisory