SAXParserFactory created without disabling external entities is vulnerable to XXE.
Disable external entities and DTDs via setFeature before parsing untrusted XML.