Many XML parsers resolve external entities by default, which lets a crafted XML document read files off your server or make it send requests. If you parse XML that a user can supply, disable external entities or use a parser that does so by default, such as Python's defusedxml.
Why it's a problem
A malicious XML document can define an entity that points at a local file or an internal URL, and a default parser will happily fetch and include it, leaking file contents or enabling server-side request forgery. It only matters when the XML is attacker-controlled, but upload endpoints and API integrations often accept exactly that.
The pattern
# Python default parser resolves external entities import xml.etree.ElementTree as ET tree = ET.parse(user_uploaded_file)
The fix
# defusedxml disables external entities and XML bombs import defusedxml.ElementTree as ET tree = ET.parse(user_uploaded_file)
Why AI tools write this
The standard library XML parser is the obvious completion for 'parse this XML,' and it works for well-formed documents. The external-entity risk is a default the assistant does not flag, because the code runs fine on the trusted files used while building.
The quick fix
- Use a hardened parser (defusedxml in Python) or explicitly disable external entities and DTDs.
- Never parse untrusted XML with a parser's default settings.
- If you only need data, consider accepting JSON instead of XML.
Common questions
Does JavaScript have an XXE problem?
The primary risk is in Python and Java with full-featured XML parsers. Node.js built-in XML support is more limited, but libraries like libxmljs can be vulnerable depending on configuration.
Is there a safe way to parse XML without switching to a different library?
With many parsers you can explicitly disable external entities and DTDs. The specific option varies by library, which is why using defusedxml in Python or a hardened alternative is simpler and less error-prone.
If I only accept JSON from clients, am I still at risk from XXE?
Only if something upstream, such as an import feature, a third-party integration, or an internal service, can supply XML that your server parses. If you never parse XML from an untrusted source, you are not exposed.