Mulesoft APIkit up to and including 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
mulesoft aplkit