Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
{ "last_known_affected_version_range": "<= 1.3.0" }