What happened
VulDB/NVD published 25 Sept 2026: the AgenticScope serializer in langchain4j uses insecure Jackson default typing leading to arbitrary class instantiation; the maintainer states it was reported 23 July, fixed 29 July, and requires the opt-in persistence feature plus write access to the store.
Why it matters
LangChain4j is a widely used Java LLM framework; while this specific path is opt-in and chained, it flags the broader pattern of agent-state persistence stores as deserialization surfaces in agent frameworks.
Attack vector
Deserialization via insecure Jackson default typing in the AgenticScope serializer; exploitation requires the application to have enabled AgenticScope persistence (opt-in), plus an attacker who can already write to that store - a chained, high-complexity, privileged scenario (public PoC exists).
Affected systems
langchain4j AgenticScope serializer up to 1.5.3-beta10 / 1.11.10-beta18 / 1.18.1-beta27 (fixed beta11/beta19/beta28; GHSA-gmwr-7wmf-mrjm)
Mitigation
Upgrade to 1.5.3-beta11 / 1.11.10-beta19 / 1.18.1-beta28 (or the corresponding stable releases); if AgenticScope persistence is not needed, leave it disabled.