Seeing as the result of this bug causes invalid XML (rather than eg a remote code execution), I'd vote to open this bug publicly.
Seeing as the result of this bug causes invalid XML (rather than eg a remote code execution), I'd vote to open this bug publicly.