CVE-2020-29128

petl before 1.68, in some configurations, allows resolution of entities in an XML document.