diff --git a/java/com/google/copybara/xml/XmlModule.java b/java/com/google/copybara/xml/XmlModule.java
index dd47385dd..ddfd785c0 100644
--- a/java/com/google/copybara/xml/XmlModule.java
+++ b/java/com/google/copybara/xml/XmlModule.java
@@ -55,6 +55,12 @@ public Object compile(String xmlContent, String expression, String type)
     DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();
     DocumentBuilder builder;
     try {
+      // Prevent XML External Entity (XXE) processing: reject DTDs (which also
+      // disables entity resolution) and external entities, since the parsed XML
+      // content may come from an untrusted source (e.g. a migrated repository).
+      builderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+      builderFactory.setXIncludeAware(false);
+      builderFactory.setExpandEntityReferences(false);
       builder = builderFactory.newDocumentBuilder();
     } catch (ParserConfigurationException e) {
       throw new RuntimeException("Error creating document builder for parsing XML");