Apache HertzBeat versions before 1.7.0 contain an XML Injection vulnerability that allows remote code execution (RCE) when parsing HTTP sitemap XML responses. Exploitation requires an authenticated user with access to add a monitor parsed by XML. The issue is fixed in version 1.7.0.