diff --git a/WeChat/Contracts/Tools.php b/WeChat/Contracts/Tools.php
index a9bf0a9..247bfe6 100644
--- a/WeChat/Contracts/Tools.php
+++ b/WeChat/Contracts/Tools.php
@@ -143,7 +143,10 @@ class Tools
      */
     public static function xml2arr($xml)
     {
-        return json_decode(self::arr2json(simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOCDATA)), true);
+        $entity = libxml_disable_entity_loader(true);
+        $data = (array)simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOCDATA);
+        libxml_disable_entity_loader($entity);
+        return json_decode(self::arr2json($data), true);
     }
 
     /**