CVE-2025-65570

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it during OP_INSTANCEOF. As a result, OP_NEXT interprets the array as an iterator object and reads the iterCmd function pointer from an invalid structure, potentially causing a crash or enabling code execution depending on heap layout.

• CWE-843

• https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.htmlExploit, Third Party Advisory
• https://blog.mcsky.ro/writeups/2025/11/15/inline8-writeup.htmlExploit, Third Party Advisory

Published

Dec 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65564A denial-of-service vulnerability exists in the omec-upf (up…7.5
• CVE-2025-65565A denial-of-service vulnerability exists in the omec-project…7.5
• CVE-2025-65566A denial-of-service vulnerability exists in the omec-project…7.5
• CVE-2025-65567A denial-of-service vulnerability exists in the omec-project…7.5
• CVE-2025-65568A denial-of-service vulnerability exists in the omec-project…7.5
• CVE-2025-6557Insufficient data validation in DevTools in Google Chrome on…5.4
• CVE-2025-65572Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSk…6.1
• CVE-2025-65573Cross Site Request Forgery (CSRF) vulnerability in AllskyTea…8.8
• CVE-2025-6558Insufficient validation of untrusted input in ANGLE and GPU …8.8
• CVE-2025-65581An open redirect vulnerability exists in the Account module …5.3
• CVE-2025-65589nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XS…6.1
• CVE-2025-6559Multiple wireless router models from Sapido have an OS Comma…9.8