defusedxml

XML bomb protection for Python stdlib modules

Here are some articles that you may find helpful