Gezine releases CivSwitch 1.0, a flaw in Civilization VII's chat that runs code on Switch 2 from a game save, as a proof of concept
On Nov 1, 2026, developer Gezine released CivSwitch 1.0. It uses an XSS flaw in the multiplayer chat of the Switch 1 edition of Civilization VII: the chat accepts text that ends up being run as code. With it, the console runs JavaScript code in userland, meaning only at the app level, without access to the system's core. It is the physical-cartridge exploit (the way to take advantage of the flaw) that Gezine had mentioned before. Broadly speaking, a small microcontroller pretends to be a USB keyboard and types the code into the chat; then an installation step done from a computer writes the code into the game's save, and from then on it runs whenever that save is loaded when the game is opened, without needing a computer or SmileBASIC.
@gezine_dev · X · Nov 01, 2026
Context
According to the project's README, only version 1.0.0 of the game on a physical cartridge is supported. According to the author, the Switch 2 version is code-in-a-box (the box only contains a code to download the game, with no game on a cartridge) and the digital version does not work. The README says it was tested on Switch 2 on firmware 20.4.0 and 23.0.1 and on Switch 1 on firmware 22.5.0, and that it should work from firmware 20 up to 23.0.1. The installation erases Civilization VII's single-player saves on the console. Limits: it runs only in userland, with no kernel, no CFW (modified system) and no backup loader. It is research and a proof of concept, with a risk of brick and ban. Credits, according to the README: the code's base comes from Netflix-N-Hack, and the microcontroller's program from Pico-Switch-Controller. GBAtemp notes that games used for exploits tend to sell out quickly. This site does not publish step-by-step guides or download links.