2026-02-20-xxe.md

category	newQuery

• Added a new query, rust/xxe, to detect XML external entity (XXE) vulnerabilities in Rust code that uses the libxml crate (bindings to C's libxml2). The query flags calls to libxml2 parsing functions with unsafe options (XML_PARSE_NOENT or XML_PARSE_DTDLOAD) when the XML input comes from a user-controlled source.