[exasperaited]

Are the security concerns not about libxslt, rather than XSLT?

[righthand]

They are about libxslt but Mason Freed doesn’t want you to know that. They could contribute a rust project which has already implemented XSLT 1.0 thus matching the browsers. But that would good software engineering and logical.