CVE-2026-19136

Published Sep 10, 2026 CVSS 4.0 · 8.4 High EPSS 1.1% KEV · Not listed

Description

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.

Analysis

Technical impact

A command injection flaw exists in the Lenovo Tianxi AI Agent PC Application that enables a local user to execute arbitrary operating system commands by opening a specially crafted link CWE‑78 and can lead to complete compromise of the affected system, exposing all data and processes to the attacker.

Affected Systems

All installations of the Lenovo Tianxi AI Agent PC Application distributed in the Chinese market, regardless of version, are potentially vulnerable until updated. The vendor’s advisory lists version 4.2.1.8111 or later as containing the fix.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.4, indicating high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, but the lack of exploitation evidence does not reduce the risk of local exploitation. Attacks require a local user to open a malicious link within the application, meaning any user with access to the system could trigger the flaw control.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Lenovo

Tianxi AI Agent PC Application

unaffected

Version	Status	Constraints
`0`	affected	< 4.2.1.8111

No data.

Vendor Product Versions

Lenovo

Tianxi Ai Agent Pc Application

Version	Status	Scheme	Platform
`[0,4.2.1.8111)`	affected	generic	—

Remediation

Vendor Solution

Update Tianxi AI Agent PC Application version to 4.2.1.8111 or later.

OpenCVE Recommended Actions

Update the Tianxi AI Agent PC Application to version 4.2.1.8111 or newer, as advised by Lenovo.
If patching is not immediately possible, block or sanitize any input sources that could generate the malformed links that the application processes to prevent the injection path.
Monitor the system for abnormal command execution events or stray enforce strict logging and alerting.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.125% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://iknow.lenovo.com.cn/detail/442249

History

Sep 11, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 11, 2026 5:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Potential Command Injection in Lenovo Tianxi AI Agent PC Application

Sep 11, 2026 2:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Potential Command Injection in Lenovo Tianxi AI Agent PC Application

Sep 10, 2026 9:15 PM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.
First Time appeared		Lenovo Lenovo tianxi Ai Agent Pc Application
Weaknesses		CWE-78
CPEs		cpe:2.3:a:lenovo:tianxi_ai_agent_pc_application::::::::
Vendors & Products		Lenovo Lenovo tianxi Ai Agent Pc Application
References		https://iknow.lenovo.com.cn/detail/442249
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`