CivSwitch: Civilization VII exploit for Switch & Switch 2
By Tgames · · 3 min read
Gezine releases CivSwitch: the Civilization VII cartridge becomes an entry point on Switch and Switch 2, up to 23.0.1, via a Raspberry Pi Pico.
A new entry point, through a cartridge game
On 1 November 2026, developer Gezine released CivSwitch 1.0 on GitHub. The tool exploits an XSS vulnerability in the multiplayer chat of Civilization VII, in its edition for the original Switch: JavaScript code typed into the chat runs in the game. After SmileBASIC 4, used by ns2jb, this is a second way in through a game, and this time through a cartridge, which Nintendo cannot pull from the eShop.
According to the README, all firmware versions of the Switch 1 and Switch 2 from 20.0.0 up to 23.0.1, the latest, should work. The author tested it on a Switch 1 on 22.5.0 and on Switch 2 consoles on 20.4.0 and 23.0.1.
What you need
How it works
What it allows, and what it does not
CivSwitch provides JavaScript execution within the game, and nothing more for now: it is neither a custom firmware nor a homebrew loader, and the code stays inside Civilization VII's sandbox. It is a foundation for developers, as ns2jb was at launch. The core of the exploit is inspired by Netflix-N-Hack's, and the Pico firmware builds on Pico-Switch-Controller.
Our advice
If the scene interests you, the version 1.0.0 cartridge becomes the item to find: GBAtemp still saw it at around £30 in the UK, but prices of exploitable games usually rise quickly. Do not update your console beyond 23.0.1, and do not install any game update. The only official repository is Gezine's: beware of fake tools published on GitHub. In July, Gezine had already shown an offline userland exploit on both consoles. Questions belong in the Switch & Wii U Questions/Help.
Sources: CivSwitch (GitHub) · Version 1.0 (GitHub) · Gezine's announcement (X) · GBAtemp
A new entry point, through a cartridge game
On 1 November 2026, developer Gezine released CivSwitch 1.0 on GitHub. The tool exploits an XSS vulnerability in the multiplayer chat of Civilization VII, in its edition for the original Switch: JavaScript code typed into the chat runs in the game. After SmileBASIC 4, used by ns2jb, this is a second way in through a game, and this time through a cartridge, which Nintendo cannot pull from the eShop.
According to the README, all firmware versions of the Switch 1 and Switch 2 from 20.0.0 up to 23.0.1, the latest, should work. The author tested it on a Switch 1 on 22.5.0 and on Switch 2 consoles on 20.4.0 and 23.0.1.
What you need
- the cartridge of Civilization VII at version 1.0.0: it is the only one supported. A newer version of the game or the eShop version will not work;
- a Raspberry Pi Pico (RP2040) or Pico 2 (RP2350). Plugged into the console, it poses as a USB keyboard and types the code into the chat, in about 87 lines and 15 to 20 minutes. Precompiled UF2 firmwares for both boards come with version 1.0;
- the console set to English (United States), for both system language and USB keyboard, so that the Pico types the right characters. Recent firmwares may not need this;
- a connection through 90DNS, which blocks Nintendo's servers, and a PC on the same network, with Python.
How it works
- in the game: Multiplayer, Wireless, Create Game, Host Lobby, then the chat. You then plug in the Pico, which types the code;
- the code launches a remote JavaScript loader, which listens on TCP port 9026: the PC can then send it any script;
- an installer, run from the PC, writes a trigger into the game save. After that, at every launch, just choose Load Game and the code runs again, without the Pico. It even survives sleep mode;
- warning: the installer erases the single-player saves of Civilization VII (the saves/Single folder). Back up your saves first.
What it allows, and what it does not
CivSwitch provides JavaScript execution within the game, and nothing more for now: it is neither a custom firmware nor a homebrew loader, and the code stays inside Civilization VII's sandbox. It is a foundation for developers, as ns2jb was at launch. The core of the exploit is inspired by Netflix-N-Hack's, and the Pico firmware builds on Pico-Switch-Controller.
Our advice
If the scene interests you, the version 1.0.0 cartridge becomes the item to find: GBAtemp still saw it at around £30 in the UK, but prices of exploitable games usually rise quickly. Do not update your console beyond 23.0.1, and do not install any game update. The only official repository is Gezine's: beware of fake tools published on GitHub. In July, Gezine had already shown an offline userland exploit on both consoles. Questions belong in the Switch & Wii U Questions/Help.
Sources: CivSwitch (GitHub) · Version 1.0 (GitHub) · Gezine's announcement (X) · GBAtemp
No comments