XEE injection security fix. Issue #826. Reported by Alvaro Munoz.