First Switch 2 jailbreak: ns2jb runs through SmileBASIC on 23.0.1

The first Switch 2 jailbreak: ns2jb, by pepsipu, runs native code on firmware 23.0.1 through SmileBASIC 4. Software-only, it is gone after a reboot.


The announcement

Sammy Hajhamid, aka pepsipu, announced on X on 22 October 2026 at around 6 a.m. (Paris time) that the Switch 2 had been jailbroken. The blog post, dated 18 October, presents ns2jb, a software-only, tethered jailbreak for firmware 23.0.1, the latest system version. The code has been on GitLab since 21 October. As far as the author knows, it is the first exploit of this level on the console. To show it off, Mario Kart World, a Switch 2 exclusive, was modded to race with Cinnamoroll, Peter Griffin or Hatsune Miku.


How it works

• The entry point is SmileBASIC 4, a Switch 1 programming app sold on the eShop. An integer overflow in the REMOVE command of its interpreter gives out-of-bounds reads and writes, then code execution inside the game;
• a buffer overflow in the fs system module, which handles files, when normalising paths containing /..\, then gives arbitrary reads and writes inside that module;
• by swapping the program that the console's loader opens, the exploit launches its own code with the rights of any ordinary system module, and uses that to patch the code of fs itself.

The browser route (WebKit), a classic on consoles, was dropped: its protections (PAC, CFI, execute-only memory) blocked access to the system.


A jailbreak found with Codex

The author handed a large part of the work to Codex, OpenAI's coding agent, which found both bugs and built most of the chain. The test rig: two JetKVMs, which send controller inputs and capture the HDMI output, and a Bluetooth switch that presses the power button when the console crashes. The jailbreak took about two weeks, the Mario Kart World mod a single day.


What it allows, and what it doesn't

According to the blog post, ns2jb can run homebrew, study and mod Switch 2 games, copy your saves off the console and access most peripherals. But:

• it is tethered: everything is gone after a reboot, and the whole procedure has to be done again;
• it is not custom firmware: among the system's built-in modules, only fs is compromised. The author hopes this work will help the scene move towards CFW;
• the released package is a demo: it runs two small native functions inside fs, checks the result and restores the original code. It installs nothing and cannot launch homebrew yet;
• you need SmileBASIC 4 version 4.4.9, firmware 23.0.1, a computer running macOS or Linux with Node.js 22 or later on the same network as the console, and over 20 MiB free in the SmileBASIC save. The 21 October test only succeeded on the third boot;
• the author warns at the top of the README that the packaging was done by Codex and has not been reviewed.

The exploit has also been tested on the Switch 1, but not packaged yet.


If you own a Switch 2

Nintendo can pull SmileBASIC 4 from the eShop, as the author points out: an eShop game can be withdrawn, the browser cannot. An upcoming system update will most likely patch the bugs. If you follow the scene, stay on 23.0.1 and don't update lightly. For everything else, be patient: ns2jb is a foundation for developers, not yet a tool for everyone. Beware of any "Switch 2 jailbreak" sold or offered anywhere other than the author's repository. Back in July, Gezine had already shown an offline userland exploit, limited to an application's sandbox. Questions are welcome in the forum section Questions/Help Switch & Wii U.


Sources: pepsipu's blog post · ns2jb (GitLab) · Announcement on X