Parsing XML with noent:true (libxmljs) substitutes external entities, allowing file read / SSRF via a crafted DTD.
Parse untrusted XML with noent:false (the default) and without DTD/network loading.