XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the createParser method of PatternParser, which sets only http://apache.org/xml/features/nonvalidating/load-external-dtd to false and leaves disallow-doctype-decl, external-general-entities,...