CVE-2017-5992: Improper Restriction of XML External Entity Reference in Openpyxl

The vulnerability stemmed from Openpyxl's use of lxml's default XML parser which resolved external entities. The key vulnerable function was openpyxl.xml.functions.fromstring, which directly handled XML parsing without entity restrictions. This function was called during critical parsing operations like reading workbook properties (read_properties), styles, and other XML-based components of .xlsx files. The patch explicitly added resolve_entities=False to XMLParser initialization, confirming these were the injection points for XXE payloads.