Your SDK dependencies may be parsing untrusted XML without protection — and you wouldn’t know until an incident.