XXE: the document asks the parser to read a local file
<!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>
A parser with entity resolution enabled will read that URI and place the contents in the document — local files, or internal HTTP services the parser can reach but you cannot. This validator reports the declaration and the URI, and never resolves it. Use defusedxml in Python, FEATURE_SECURE_PROCESSING in Java, or DtdProcessing.Prohibit in .NET.
xml.external_entity · run this example
Two root elements is not a document
<record id="1"/><record id="2"/>
XML permits exactly one outermost element. This shape arrives whenever records are concatenated or a log is appended to, and it needs an enclosing element or to be split into separate documents. Several well-formedness checkers report it as valid.
xml.multiple_roots · run this example
An unbound prefix passes a syntax check and fails in production
<soap:Envelope><soap:Body/></soap:Envelope>
With no xmlns:soap declaration, a raw XML parser treats "soap:Envelope" as an ordinary element name and reports the document well-formed. Every namespace-aware consumer — XPath, XSLT, SOAP itself, schema validators — rejects it. So it validates locally and breaks on arrival.
xml.undeclared_namespace_prefix · run this example
HTML entities do not exist in XML
<p>Hello world</p>
XML predefines exactly five entities: < > & ' and ". , ©, — and the rest are HTML, and are undefined here without a DTD. Use the numeric reference ( ) or the character itself in UTF-8.
xml.undefined_entity · run this example
A URL in an element is the most common XML error there is
<link>https://a.com/?x=1&y=2</link>
A bare & starts an entity reference. Any query string with two parameters breaks the document unless it is written &. This is the single most frequent cause of "not well-formed" in feeds and sitemaps.
xml.bare_ampersand · run this example
Billion laughs: a few lines that expand to gigabytes
<!DOCTYPE b [<!ENTITY a "aa"><!ENTITY b "&a;&a;&a;&a;">]><r>&b;</r>
Nested entity expansion multiplies. Ten entities each referencing the previous one ten times expands to 10^10 characters from a few lines of XML, exhausting memory during parsing. This validator counts the nesting and reports it without performing the expansion.
xml.entity_expansion · run this example