CVE-2026-97869 | langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27 LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization (GHSA-gmwr-7wmf-mrjm)

A vulnerability was found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. It has been rated as problematic. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization.

This vulnerability is registered as CVE-2026-97869. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Upgrading the affected component is advised.

The project maintainer kindly explains: “The issue was reported to us privately on 23 July 2026 and fixed in releases published on 29 July 2026. It is tracked as GHSA-gmwr-7wmf-mrjm. Exploitation requires an application to have enabled AgenticScope persistence, which is opt-in, and an attacker who can already write to that store. All maintained release lines have been patched.”VulDB Recent EntriesRead More