XML injection includes XXE (XML External Entity) attacks — referencing external entities in XML to read local files, SSRF, or DoS via entity expansion (billion laughs attack).
XXE is in OWASP Top 10. Prevention: disable external entity processing in XML parsers. Most XML parsers enable XXE by default — explicitly disable it. XXE can read /etc/passwd, cloud metadata, internal files.