Description
A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.
Published: 2026-09-10
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Command Execution
Action: Immediate Patch
AI Analysis

Impact

A command injection flaw exists in the Lenovo Tianxi AI Agent PC Application that enables a local user to execute arbitrary operating system commands by opening a specially crafted link CWE‑78 and can lead to complete compromise of the affected system, exposing all data and processes to the attacker.

Affected Systems

All installations of the Lenovo Tianxi AI Agent PC Application distributed in the Chinese market, regardless of version, are potentially vulnerable until updated. The vendor’s advisory lists version 4.2.1.8111 or later as containing the fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, indicating high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, but the lack of exploitation evidence does not reduce the risk of local exploitation. Attacks require a local user to open a malicious link within the application, meaning any user with access to the system could trigger the flaw control.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Remediation

Vendor Solution

Update Tianxi AI Agent PC Application version to 4.2.1.8111 or later.

OpenCVE Recommended Actions

  • Update the Tianxi AI Agent PC Application to version 4.2.1.8111 or newer, as advised by Lenovo.
  • If patching is not immediately possible, block or sanitize any input sources that could generate the malformed links that the application processes to prevent the injection path.
  • Monitor the system for abnormal command execution events or stray enforce strict logging and alerting.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://iknow.lenovo.com.cn/detail/442249 cve-icon cve-icon
History

Fri, 11 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Potential Command Injection in Lenovo Tianxi AI Agent PC Application

Fri, 11 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Title Potential Command Injection in Lenovo Tianxi AI Agent PC Application

Thu, 10 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.
First Time appeared Lenovo
Lenovo tianxi Ai Agent Pc Application
Weaknesses CWE-78
CPEs cpe:2.3:a:lenovo:tianxi_ai_agent_pc_application:*:*:*:*:*:*:*:*
Vendors & Products Lenovo
Lenovo tianxi Ai Agent Pc Application
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Lenovo Tianxi Ai Agent Pc Application
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2026-09-11T14:48:37.817Z

Reserved: 2026-08-06T16:32:34.925Z

Link: CVE-2026-19136

cve-icon Vulnrichment

Updated: 2026-09-11T14:48:30.348Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T21:17:24.613

Modified: 2026-09-11T15:17:00.503

Link: CVE-2026-19136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T07:30:09Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')