diff --git a/Ghidra/Features/Base/.launch/Ghidra Code Coverage.launch b/Ghidra/Features/Base/.launch/Ghidra Code Coverage.launch
index 179995684d..72fe91facf 100644
--- a/Ghidra/Features/Base/.launch/Ghidra Code Coverage.launch
+++ b/Ghidra/Features/Base/.launch/Ghidra Code Coverage.launch
@@ -1,5 +1,6 @@
+
@@ -28,6 +29,6 @@
-
+
diff --git a/Ghidra/Features/Base/.launch/Ghidra.launch b/Ghidra/Features/Base/.launch/Ghidra.launch
index f518159878..84bb740495 100644
--- a/Ghidra/Features/Base/.launch/Ghidra.launch
+++ b/Ghidra/Features/Base/.launch/Ghidra.launch
@@ -1,6 +1,7 @@
+
@@ -30,5 +31,5 @@
-
+
diff --git a/Ghidra/Features/Base/.launch/Headless.launch b/Ghidra/Features/Base/.launch/Headless.launch
index ecdf31e1ef..3fca8ef680 100644
--- a/Ghidra/Features/Base/.launch/Headless.launch
+++ b/Ghidra/Features/Base/.launch/Headless.launch
@@ -31,5 +31,5 @@
-
+
diff --git a/Ghidra/Features/Base/.launch/JShell.launch b/Ghidra/Features/Base/.launch/JShell.launch
index c657097019..b10bb73a10 100644
--- a/Ghidra/Features/Base/.launch/JShell.launch
+++ b/Ghidra/Features/Base/.launch/JShell.launch
@@ -1,6 +1,7 @@
+
@@ -30,5 +31,5 @@
-
+
diff --git a/Ghidra/RuntimeScripts/Common/support/launch.properties b/Ghidra/RuntimeScripts/Common/support/launch.properties
index 46a4e14060..467f53b832 100644
--- a/Ghidra/RuntimeScripts/Common/support/launch.properties
+++ b/Ghidra/RuntimeScripts/Common/support/launch.properties
@@ -83,6 +83,11 @@ VMARGS_WINDOWS=-Dlog4j.skipJansi=true
# Ghidra does not use class data sharing, so explicitly turn it off to avoid the warning.
VMARGS=-Xshare:off
+# Restrict XML external access
+VMARGS=-Djavax.xml.accessExternalDTD=
+VMARGS=-Djavax.xml.accessExternalSchema=
+VMARGS=-Djavax.xml.accessExternalStylesheet=
+
# Settings directory used by the application to store application settings and data that persist
# between application sessions, system reboots, and periodic system cleanup. Overridden values
# are required to be absolute paths. The current user name may be incorporated into the settings