Issue 17538: Document XML vulnerabilties
diff --git a/Misc/NEWS b/Misc/NEWS
index 2bbc633..adf78de 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -24,6 +24,11 @@
 - Issue #17531: Fix tests that thought group and user ids were always the int
   type. Also, always allow -1 as a valid group and user id.
 
+Documentation
+-------------
+
+- Issue 17538: Document XML vulnerabilties
+
 
 What's New in Python 2.7.4 release candidate 1
 ==============================================