The vulnerability stems from insecure XML parser configuration in ruleset processing. The GitHub issue #1650 explicitly states PMD used default Java XML parser settings (which enable external entities) prior to the 2017 fix. Standard XXE mitigation involves disabling DTDs and external entities via features like XMLConstants.FEATURE_SECURE_PROCESSING. The RuleSetFactory and ResourceLoader classes are core components for ruleset parsing, making their XML parser initialization methods the most likely vulnerable points. The high confidence comes from the direct match between the described vulnerability pattern (CWE-611) and typical Java XXE vulnerabilities in XML parsing code paths.