What happened
Published 2026-09-25 (CVSS 4.1 v3.1 / 1.2 v4.0; CISA SSVC exploitation='poc'): deserialization in LangChain4j-agentic's AgenticScopeSerializer.fromJson with a published exploit write-up; the maintainer notes it requires opt-in AgenticScope persistence plus attacker write access to that store.
Why it matters
LangChain4j is a leading Java agent framework; an insecure-deserialization primitive in its agentic scope-persistence layer is a classic RCE class that becomes reachable where persistent agent state is attacker-influenceable — limited blast radius here because persistence is opt-in and store-write is required, hence Tier C.
Attack vector
Insecure Jackson default typing in the AgenticScope deserialization path (CWE-502) enables arbitrary class instantiation when deserializing attacker-controlled AgenticScope persistence content — potential RCE in the Java agent runtime if the attacker can poison the scope store.
Affected systems
langchain4j up to 1.5.3-beta10 / 1.11.10-beta18 / 1.18.1-beta27 (LangChain4j-agentic AgenticScopeSerializer.fromJson). Fixed in 1.5.3-beta11 / 1.11.10-beta19 / 1.18.1-beta28 (GHSA-gmwr-7wmf-mrjm).
Mitigation
Upgrade to 1.5.3-beta11 / 1.11.10-beta19 / 1.18.1-beta28; do not enable AgenticScope persistence for untrusted-writer stores.