The CodeQL CLI is vulnerable to an XML External Entity attack due to an XML parser used to read auxiliary files. This vulnerability can be exploited when processing maliciously modified CodeQL databases or specially prepared QL query sources, potentially leading to a loss of privacy or exfiltration of secrets. Security researchers and QL authors who receive databases or QL source files from untrusted sources may be impacted. Those using CodeQL for routine analysis of source trees with a preselected set of trusted queries are not affected.