xml-rs is a XML parser has open issues around parsing including integer overflows / panics that may or may not be an issue with untrusted data.
Together with these open issues with Unmaintained status xml-rs may or may not be suited to parse untrusted data.