AIKIDO-2025-10270

TL;DR

Affected versions of this package are vulnerable to XML External Entity (XXE) injection due to missing secure parsing properties in the DocumentBuilderFactory configuration. An attacker can exploit this by submitting a malicious XML payload containing external entity references, which the unsecured parser would resolve, potentially allowing unauthorized access to sensitive files, server-side request forgery (SSRF), or other XXE-based attacks.