CVE-2026-19136

CVE-2026-19136 is an operating system command injection flaw (CWE-78) in the Tianxi AI Agent PC Application, Lenovo's AI assistant software distributed exclusively in the Chinese market. It is triggered when a local user opens a specially crafted link that is then handled by the application, causing it to execute attacker-controlled OS commands with the user's privileges. Successful exploitation yields high impact to confidentiality, integrity, and availability on the local machine, effectively local code execution without requiring special privileges. All users running the Tianxi AI Agent PC Application are potentially affected; the available data does not specify which version ranges are vulnerable. Exploitation status is currently quiet: the flaw is not in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Check the Lenovo PSIRT advisory (CVE-2026-19136) for affected builds and apply the patched Tianxi AI Agent version once published via Lenovo China's official update channel. Until patched, instruct users not to open untrusted or unsolicited links on machines running the agent. Because no proof-of-concept or in-the-wild exploitation is known, this can be remediated as routine high-severity patching rather than an emergency.