There are many security vulnerability vectors in xml parsing. A lot (but not all) have to do with DTD entity replacement, calls to remote URLs for schemas, and

There are many security vulnerability vectors in xml parsing. A lot (but not all) have to do with DTD entity replacement, calls to remote URLs for schemas, and the like, buffer overflows (values too large).