When libxmlloader options are teh default values, disable the entity loader as well. CVE-2014-2054 by MITRE