Avoid parsing untrusted data, such as user input, as XML. Such data may include URIs that resolve to resources outside the current context, leading to XML External Entity (XXE) injection. XXE injection occurs when XML input with references to external entities is processed without proper sanitization, potentially allowing attackers to access internal files, cause denial of service, or execute remote code.
Remediation Guidelines
Do not parse XML input with external entity processing enabled. This prevents attackers from exploiting XXE vulnerabilities.
