“it parses” does not mean “it is secure”

In the JavaScript ecosystem, many libraries prioritise ease of use or safety by omission rather than offering fine-grained security controls.

There is no actively maintained JS XML to JSON convertor that supports both internal and external entity resolution in a controlled way.

Every library misses something critical: some were unmaintained, some did not support external entities at all, others lacked meaningful security controls, and some were extremely difficult to install or configure.

👉 Full write up