Parsing an in-memory XML string/bytes value with a default parser may allow XXE attacks. Scoped to the fromstring()/XML()/parseString() forms that parse a value the program built (the classic one-line XXE), NOT parse(path_or_fd): parsing a static resource file is not attacker-controlled, and the taint-aware SHIELD-TAINT-XXE sink covers the cases where a user-controlled value reaches any XML parser across lines.
Disable external entity processing. Use defusedxml library for safe XML parsing.