xml2rfc versions prior to 3.34.0 allow script elements within SVG sources, which can lead to cross-site scripting (XSS) vulnerabilities when rendering HTML output. This issue has been fixed in version 3.34.0. The vulnerability affects websites publishing HTML drafts and RFCs using xml2rfc. Workarounds include removing script elements from SVG files if the SVG source is self-contained within the XML.