From 44641962c2b12c786890f29a0370452b0c525191 Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta01.pally@gmail.com>
Date: Mon, 25 May 2026 04:29:32 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 binding/xml.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/binding/xml.go b/binding/xml.go
index acd6f942..c1a13c76 100644
--- a/binding/xml.go
+++ b/binding/xml.go
@@ -27,6 +27,7 @@ func (xmlBinding) BindBody(body []byte, obj any) error {
 
 func decodeXML(r io.Reader, obj any) error {
 	decoder := xml.NewDecoder(r)
+	decoder.Entity = xml.HTMLEntity
 	if err := decoder.Decode(obj); err != nil {
 		return err
 	}