XMLUnit2 has an RCE vulnerability caused by XSLT #264

<dependency>
			<groupId>org.xmlunit</groupId>
			<artifactId>xmlunit-core</artifactId>
			<version>2.9.1</version>
</dependency>

import org.xmlunit.transform.Transformation;
import javax.xml.transform.Result;
import javax.xml.transform.Source;
import javax.xml.transform.stream.StreamResult;
import javax.xml.transform.stream.StreamSource;

public class xmlunit_test {
    public static void main(String[] args) {
        Transformation transformation = new Transformation();
        Source xml = new StreamSource("1.xml");;
        transformation.setSource(xml);
        Source xsl = new StreamSource("1.xsl");;
        transformation.setStylesheet(xsl);
        Result result = new StreamResult("output.xml");;
        transformation.transformTo(result);
    }
}