If you would RTFA, they're removing XSLT specifically for security reasons. They provide the following links: https://www.offensivecon.org/speakers/2025/ivan-f

If you would RTFA, they're removing XSLT specifically for security reasons. They provide the following links: https://www.offensivecon.org/speakers/2025/ivan-fratric.html https://www.offensivecon.org/speakers/2025/ivan-fratric.html > Although XSLT in web browsers has been a known attack surface for some time, there are still plenty of bugs to be found in it, when viewing it through the lens of modern vulnerability discovery techniques. In this presentation, we will talk about how we found multiple vulnerabilities in XSLT implementations across all major web browsers. We will showcase vulnerabilities that remained undiscovered for 20+ years, difficult to fix bug classes with many variants as well as instances of less well-known bug classes that break memory safety in unexpected ways. We will show a working exploit against at least one web browser using these bugs. https://nvd.nist.gov/vuln/detail/CVE-2025-7425 https://nvd.nist.gov/vuln/detail/CVE-2025-7425 https://nvd.nist.gov/vuln/detail/CVE-2022-22834 https://nvd.nist.gov/vuln/detail/CVE-2022-22834 (And, for the record, XSL is Turing-complete. It has xsl:variable, xsl:if, xsl:for-each, and xsl:apply-template function calls.)