3 ms·

I might be mistaken, but that sounds like a general XML-related security bug (of which there are plenty)