AIKIDO-2026-963222

TL;DR

DocLang XML validation parses input with lxml's default parser, which resolves entities and honors inline DTD declarations, so an attacker-supplied document can read local files or exhaust memory through external or nested entities; the Schematron backend can also re-serialize a retained DOCTYPE and expand entities downstream. Separately, the pack command copies pages and assets with helpers that follow symbolic links, so a planted symlink (including nested ones) can pull sensitive host files into the archive. The fix parses with a hardened parser that disables DTD loading and entity resolution, rejects DOCTYPE and entity nodes, strips the DOCTYPE from temporary Schematron XML, and refuses symbolic links during pack by routing copies through guarded helpers.