{"data":{"id":"bd892e03-a6e0-4e26-b8b4-7755753e19cc","title":"CVE-2026-97869: A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the…","summary":"A flaw in the AgenticScopeSerializer.fromJson function of LangChain4j-agentic, in langchain4j versions up to 1.5.3-beta10, 1.11.10-beta18 and 1.18.1-beta27, allows deserialization manipulation that can be exploited remotely, though the attack complexity is rated high. The exploit has been published, and the maintainer says exploitation requires AgenticScope persistence to be enabled and an attacker who can already write to that store.","solution":"Upgrade to version 1.5.3-beta11, 1.11.10-beta19 or 1.18.1-beta28. The maintainer states that all maintained release lines have been patched, and the issue is tracked as GHSA-gmwr-7wmf-mrjm.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97869","publishedAt":"2026-09-25T16:17:31.740Z","cveId":"CVE-2026-97869","cweIds":["CWE-20","CWE-502"],"cvssScore":"4.1","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LangChain4j"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain4j deserialization flaw in AgenticScopeSerializer.fromJson","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"high","privilegesRequired":"high","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0024,"epssCheckedAt":"2026-11-10T00:11:22.945Z","kevDateAdded":null,"advisoryAliases":["GHSA-hg7f-vffm-ppc6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-08T06:09:35.407Z","patchAvailable":null,"disclosureDate":"2026-09-25T16:17:31.740Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}