Microsoft Visual Studio 2008 Express IDE suffers from an XML external entity injection vulnerability.