[marshray]

In the meantime, can you confirm that the disabling of XML and YAML inputs fully mitigates the RCE as well as the SQLi?

[tptacek]

The vectors for both are the same. The term "SQLI" here is very misleading.

[judofyr]

Yes.