diff --git a/python/ql/src/Security/CWE-776/XmlBomb.qhelp b/python/ql/src/Security/CWE-776/XmlBomb.qhelp index f20dd526fdd..8841f98ab27 100644 --- a/python/ql/src/Security/CWE-776/XmlBomb.qhelp +++ b/python/ql/src/Security/CWE-776/XmlBomb.qhelp @@ -39,7 +39,7 @@ PyPI package, which has been created to prevent XML attacks (both XXE and XML bo

The following example uses the xml.etree XML parser provided by the Python standard library to -parse a string xml_src. That string is from an untrusted source, so this code is be +parse a string xml_src. That string is from an untrusted source, so this code is vulnerable to a DoS attack, since the xml.etree XML parser expands internal entities by default: