Release candidate 2: Fixed XXE vulnerability

RC 2 is fixing an XXE (XML eXternal Entities) vulnerability. This can lead to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter by using specially crafted XML input files.

This issue is being tracked as CVE-2022-27193.