An arbitrary file reads from malformed XML payload vulnerbility was discovered in owslib, the Python client library for Open Geospatial web services. This issue has been addressed by always using lxml as the XML parser with entity resolution disabled.