diff --git a/requirements.txt b/requirements.txt
index 63c5877..3b4417e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,4 @@
 discord.py>=2.3.2
 python-dotenv>=1.0.0
 requests>=2.31.0
+defusedxml>=7.0.0
diff --git a/utils/news.py b/utils/news.py
index b7d2f02..75665f5 100644
--- a/utils/news.py
+++ b/utils/news.py
@@ -17,12 +17,12 @@ _session = requests.Session()
 async def fetch_rss(url):
     """Скачать и распарсить RSS-ленту (RSS 2.0 / Atom)."""
     await habr_rss_limiter.acquire()
-    from xml.etree import ElementTree
+    from defusedxml.ElementTree import fromstring
 
     try:
         response = await asyncio.to_thread(_session.get, url, timeout=10)
         response.raise_for_status()
-        root = ElementTree.fromstring(response.content)
+        root = fromstring(response.content)
 
         # RSS 2.0
         ns_dc = {"dc": "http://purl.org/dc/elements/1.1/"}