This is largely historic. I had lengthy discussions about this with expat's maintainer.<p>expat, the xml library underlying python's etree and other xml interfaces, has either mitigated these standard xml vulnerabilities or disables the dangerous features by default.<p>The python docs are still a bit confusing there, but if you look at this table:
<a href="https://docs.python.org/3/library/xml.html#xml-vulnerabilities" rel="nofollow">https://docs.python.org/3/library/xml.html#xml-vulnerabiliti...</a><p>While this table has a lot of "Vulnerable" in it, they all come with footnotes saying that up-to-date versions of expat are not vulnerable.<p>So... if you want to have more secure xml parsing in python, make sure you use an up-to-date expat library or one where security fixes have been backported. You don't need anything else.