#164 CyberNeko seems to be vulnerable to XXE attack.

[Danor Cohen]

CyberNeko seems to be vulnerable to high security vulnerability called XXE attack. (https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing).

CyberNeko became vulnerable because of the fact that it uses "xerces.xni" for its internal xml parsing process. This parser is vulnerable to XXE attack and proper flags are required in order to protect it from that attack.
Read more in the following OWASP document:

https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet

[RBRi]

Mitigate in https://github.com/HtmlUnit/htmlunit-neko