A Civilization VII cartridge becomes a Switch code loader through its chat box
The public toolchain reports userland execution on both Switch generations, with a strict physical-game requirement and a chat input doing the unexpected work.
Civilization VII’s chat box has acquired a job outside diplomacy. CivSwitch uses a chat cross-site-scripting payload to start a JavaScript loader, with a small USB keyboard-emulating device entering the text. The next turn could involve code the game shipped with no intention of running, provided the cartridge and version match the project requirements.
The CivSwitch repository calls itself an XSS toolchain for the Switch 1 edition of the game. Its first compatibility restriction is unusually important: only version 1.0.0 on a physical cartridge is supported. Owning a game with the right title is therefore insufficient. Edition, medium and version all belong in the same sentence before somebody spends money on the wrong copy.
The project describes two main components. PicoSwitch is firmware for RP2040 and RP2350 microcontroller boards that act as a USB keyboard and type the chat payload. The default payload starts the shared exploit core and a remote JavaScript loader. A separate installer creator packages a JavaScript payload with a save-data trigger for the project’s persistent installation path.
That division explains the clever part without treating it as supernatural console access. A familiar input device enters text; the game interprets that input in a way that lets script run; the loader then supplies a route for further JavaScript. The keyboard has not gained a privilege simply by being a keyboard. The vulnerable interpretation of the chat text supplies the opening.
The repository describes the outcome as “userland code execution.” That scope matters. The README offers no basis for turning it into a claim of full kernel control, a universal jailbreak or guaranteed access across every game revision. A loader can be impressive while still operating inside a particular process’s limits.
The project’s listed tests cover a Switch 1 on firmware 22.5.0 and a Switch 2 on firmware 20.4.0 and 23.0.1. The README also makes a broader compatibility expectation. Reported tests and expected support should stay separate; a sentence saying something should work has not tested another console for you (wouldn’t that be convenient).
For a shopper, the relevant product is the physical Switch edition of Civilization VII. That search is only a buying route. It verifies neither a seller’s cartridge revision nor the software version a console will actually run. The repository’s strict requirement still needs checking against the specific copy.
The published toolchain describes a specific result: a retail game’s chat input becomes the entry point for a script loader, and an ordinary keyboard protocol carries the initial text. Compatibility remains attached to the game people would normally buy simply to play.
Diplomacy now accepts JavaScript.