TL;DR
A post on pepsipu.com reports ns2jb, a software-only, tethered jailbreak for the Switch 2 running firmware 23.0.1. Its author says it can run native code with sysmodule privileges and demonstrated a Mario Kart World mod, but the supplied report does not include independent verification or the full technical account of how the final privilege escalation works.
A researcher has reported ns2jb, a software-only, tethered jailbreak for Nintendo Switch 2 on firmware 23.0.1, claiming it can run native code with sysmodule privileges. The report describes possible uses including homebrew, game modification and save-file backups, but the available material does not establish independent verification or explain every step of the exploit chain.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The author says the jailbreak can run arbitrary native code as an ordinary sysmodule and as the system’s built-in fs sysmodule. Those privileges are the basis for the listed capabilities: running homebrew, reverse-engineering or modifying games, copying save files off the console, and accessing many peripherals. The author calls it, to their knowledge, the first exploit of this kind for Switch 2; that is the author’s characterization, not an independently established finding.
As a demonstration, the report shows a modification to Mario Kart World, a Switch 2 exclusive, adding characters. The author says the mod was made in a day, while the jailbreak work took about two weeks. They also clarify that a caption suggesting an AI coding agent had been told simply to “jailbreak the Switch 2” was a joke: an attempted goal of reaching userland code execution did not succeed on its own, and the work required substantial effort.
The author describes multiple research paths. One began with WebKit and a custom Wi-Fi captive portal, but the report says that route ran into protections including execute-only memory, pointer authentication and control-flow integrity. Another path targeted SmileBASIC, a Switch 1 game, where the researcher says an integer overflow in array removal enabled out-of-bounds memory access and eventually return-oriented programming. The supplied report excerpt ends as the author turns to gaining access to more privileged processes, so it does not provide the complete account of how the final sysmodule-level access was achieved.
What Sysmodule Access Could Enable
If the reported privileges work as described, the jailbreak could let researchers and users run homebrew software and examine how Switch 2 games and system components behave. The claimed access to save files and peripherals could also support research and user modifications that are not available through Nintendo’s standard software environment.
The development also matters to console security: a working software exploit may prompt further investigation by researchers and a response from Nintendo. But a report of an exploit is not the same as a broadly usable or independently tested release. The tethered nature of ns2jb and its stated firmware support limit what can be inferred about its reach.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
Jackery Solar Generator 1000 v2 with Two 100W Solar Panels, 1024Wh LiFePO4 Battery
Apple Watch Series 11 GPS + Cellular, 46mm Jet Black Aluminum Case with Black Sport Band (M/L)
As an affiliate, we earn on qualifying purchases.
Two Exploit Paths in the Report
The author first investigated WebKit, a common target in console security research, using a custom captive portal. According to the report, that route achieved a control-flow hijack but did not provide a straightforward way to make arbitrary inter-process communication calls. The author points to protections including PAC and CFI as barriers to turning that browser access into the desired system privileges.
The report then describes using a Switch 1 version of SmileBASIC as a route to code execution. The researcher says an integer overflow in its array-removal operation allowed memory to be read and written out of bounds, and that this path led to ROP. The material provided explains this stage, but not the full subsequent escalation to the reported Switch 2 sysmodule capabilities. The author also says they cannot publicly disclose findings from another Switch 1 game they investigated.
“ns2jb is a software-only, tethered jailbreak for the Switch 2.”
— The ns2jb report’s author
Verification and Exploit Limits
The source material is a researcher’s own account, and it does not include independent confirmation that ns2jb works as described. The supplied excerpt also stops before detailing how the researcher moved from the SmileBASIC exploit to privileged Switch 2 processes, leaving a central part of the claimed chain undocumented here.
It is not clear whether the exploit works on firmware versions other than 23.0.1, how reliably it can be run, whether a public repository currently contains a complete usable release, or whether Nintendo has responded. “Tethered” indicates a limitation, but the excerpt does not spell out the exact restart or setup requirements. The report’s claims about save access, peripherals and game modification should therefore be treated as reported capabilities, not independently tested outcomes.
Release Details and Nintendo Response
The next milestones are fuller technical documentation, independent testing and clarification of the exploit’s exact firmware and setup requirements. The report points readers to an ns2jb repository, but the supplied material does not confirm its contents or release status. No Nintendo response is included. Until more details or verification are available, the scope and practical availability of the jailbreak remain unsettled.
Key Questions
What is ns2jb?
ns2jb is the name the report gives to a software-only, tethered jailbreak for Switch 2 firmware 23.0.1. Its author says it can run native code with sysmodule privileges.
What can the reported jailbreak do?
The author lists homebrew, game research and modification, save-file backups and access to many peripherals. These are capabilities claimed in the report and have not been independently verified in the supplied material.
Does it work on every Switch 2?
The report identifies firmware 23.0.1 as the current supported version. It does not establish compatibility with other firmware versions or every console.
What does tethered mean here?
The author describes ns2jb as tethered, but the available excerpt does not explain the exact process needed to start it or recover after a restart. Those practical details remain unclear.
Has Nintendo confirmed the vulnerability?
No Nintendo statement is included in the source material. The account is a researcher’s report, and independent confirmation or a company response was not provided.
Source: hn
