Summary

Components affected:

• Game software (Xenoblade Chronicles X: Definitive Edition) on Nintendo Switch

The issue was fixed in the 1.0.2 version of the game, released globally on Apr 23, 2025.

Description

When receiving the player's profile name and avatar name from other players online, the game could interpret text as special formatting tags that could alter formatting or insert text. The most impactful tags required save editing due to the game's name length limit of 10 characters, but some tags could also be used by regular users with no modifications.

Impact

A malicious user could exploit the issue to create names with special formatting (e.g. colors), as well as bypassing the profanity filter with formatting tags that equate to spaces or zero-width characters. The names would also be visible to other users through online multiplayer.