xxe vulnerability in ebookmeta.get_metadata()

[peri0d]

I found that when the ebookmeta version is less than 1.2.8 and the lxml version is less than 4.9.1, the ebookmeta.get_metadata function will have an xxe vulnerability. An attacker could use this vulnerability to read sensitive information from the server.