Lenovo reports command injection flaw in Tianxi AI Agent PC app

A command injection vulnerability has been reported in the Tianxi AI Agent PC Application, software distributed exclusively in the Chinese market, according to a CVE record published by the US National Vulnerability Database on 10 September 2026. The flaw is tracked as CVE-2026-19136 and could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.

The NVD entry describes the issue as "a potential command injection vulnerability" and points to a Lenovo knowledge base advisory as its only reference. A matching advisory, GHSA-w44r-4p8w-x8cm, was published in the GitHub Advisory Database on the same day and repeats the same description word for word. Neither record lists an affected version range or a fixed build.

Command injection means untrusted input reaches a part of the program that passes text to the operating system to run, so attacker-supplied text becomes a command rather than just data. In this case the untrusted input arrives through a link that the application is registered to handle. Desktop applications commonly register a custom URL scheme so that clicking a link in a browser, chat client or document opens the application and passes it parameters. If those parameters are not properly separated from the command the application builds, the link can carry instructions of the attacker's choosing.

Both advisories say the user must be local and must open the link, which means some interaction is required rather than a fully remote, unattended exploit. The published records do not describe how an attacker would get a victim to open the link, and they do not say whether the flaw has been used in the wild.

The records also do not state whether a patch is available, and the advisory text does not include mitigation advice beyond the description of the problem. The NVD entry carried no severity score from the vendor or from NVD at the time of publication. Readers who use the application should consult Lenovo's own knowledge base advisory, which is the reference cited by both databases, for any version and update information.

The case is a reminder that AI agent products on the desktop inherit the security problems of ordinary desktop software. An agent application is still a program with an installer, a process running under a user account and, often, a registered URL handler that other software can trigger. That handler is an entry point for input the developer does not control. Where the application also has the ability to run commands or scripts as part of its normal work, an injection flaw in that entry point puts the operating system within reach of whoever writes the link.

For defenders, the practical questions are narrow. Which machines have the application installed, which URL schemes it registers, and whether those schemes can be reached from a browser or an email client are all things that can be checked without waiting for a severity score. Blocking or unregistering a custom scheme is a common containment step for this class of flaw, although neither advisory recommends it in this instance.

The Agentic Times has relied only on the two published advisory records for this report. No further technical detail, exploit code or affected-version list was available in those sources at the time of writing.