[edit: I finally finished reading everything. It seems like these new leaks can be triggered from JS as they still fundamentally reduce to "read time for memory access"]

For spectre simply having attacker directed control flow was sufficient - so logically almost any scripting language could be exploited.

Same goes for most of the TLB attacks.

Others required native code because they needed to use specific instructions (that aren’t going to be emitted intentionally by any compiler - jit or otherwise).