Command injection in Tianxi AI Agent PC Application

A command injection vulnerability in Tianxi AI Agent PC Application could allow OS command execution if a local user opens a specially crafted link handled by the application.

Disclosed 10 September 2026 · Record updated 1 October 2026

Impact

Operating system commands could be executed via specially crafted links

Our coverage

A marionette puppet with tangled strings suddenly jerks rigid as unseen hands yank invisible threads, forcing its wooden limbs to execute commands against its painted will.

Vulnerabilities

Lenovo reports command injection flaw in Tianxi AI Agent PC app

CVE-2026-19136 could let a crafted link run operating system commands on machines where the agent software handles it.

14 Sept 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-19136
github.comhttps://github.com/advisories/GHSA-w44r-4p8w-x8cm