Critical · published December 29, 2025
🚨 A surprise error in jsish 2.0 could turn your code execution upside down! This sneaky type confusion can lead to crashes or worse! 🔥 Think of it like a chef accidentally mistaking a spoon for a knife while preparing a dish — that could totally ruin the recipe. In this case, the OP_NEXT opcode gets confused, treating an array like a special ingredient that’s not safe to use! An attacker could exploit this vulnerability to crash the application or potentially execute arbitrary code. This is no small issue, as a single wrong move could bring your whole system down or allow unauthorized actions — the stakes are high! ⚠️
Think of it like a chef accidentally mistaking a spoon for a knife while preparing a dish — that could totally ruin the recipe. In this case, the OP_NEXT opcode gets confused, treating an array like a special ingredient that’s not safe to use! This vulnerability arises from a type confusion during the execution of the OP_NEXT opcode when it mistakenly interprets an array as an iterator object due to incorrect control flow within a for-in loop, leaving an invalid reference on the stack.
An attacker could exploit this vulnerability to crash the application or potentially execute arbitrary code. This is no small issue, as a single wrong move could bring your whole system down or allow unauthorized actions — the stakes are high! ⚠️ Update to jsish version 2.1 or later immediately! Also, review your codebase to ensure you handle array access and type checks properly to prevent similar issues in the future. 🛡️ You've got this! Stay proactive and patch up, and you'll keep your code running smoothly! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| jsish/jsish | all versions | — |