Product
The http4s-scala-xml library is vulnerable to XML External Entity (XXE) attacks due to improper configuration of the SAXParserFactory, allowing unauthenticated attackers to perform SSRF or local file disclosure.