Are the security concerns not about libxslt, rather than XSLT?