yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.
Published September 17, 2020.
Yworks Yed