AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-20627.json"