This is largely historic. I had lengthy discussions about this with expat's maintainer. expat, the xml library underlying python's etree and other xml interfac

This is largely historic. I had lengthy discussions about this with expat's maintainer. expat, the xml library underlying python's etree and other xml interfaces, has either mitigated these standard xml vulnerabilities or disables the dangerous features by default. The python docs are still a bit confusing there, but if you look at this table: https://docs.python.org/3/library/xml.html#xml-vulnerabilities https://docs.python.org/3/library/xml.html#xml-vulnerabiliti... While this table has a lot of "Vulnerable" in it, they all come with footnotes saying that up-to-date versions of expat are not vulnerable. So... if you want to have more secure xml parsing in python, make sure you use an up-to-date expat library or one where security fixes have been backported. You don't need anything else.