patch xml/yaml exploit