Index: /trunk/src/org/openstreetmap/josm/tools/XmlObjectParser.java
===================================================================
--- /trunk/src/org/openstreetmap/josm/tools/XmlObjectParser.java	(revision 5579)
+++ /trunk/src/org/openstreetmap/josm/tools/XmlObjectParser.java	(revision 5580)
@@ -30,4 +30,6 @@
 import org.xml.sax.Locator;
 import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
 import org.xml.sax.SAXParseException;
 import org.xml.sax.XMLReader;
@@ -292,4 +294,11 @@
             XMLReader reader = saxParser.getXMLReader();
             reader.setContentHandler(contentHandler);
+            try {
+                // Do not load external DTDs (fix #8191)
+                reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            } catch (SAXException e) {
+                // Exception very unlikely to happen, so no need to translate this
+                System.err.println("Cannot disable 'load-external-dtd' feature: "+e.getMessage());
+            }
             reader.parse(new InputSource(in));
             queueIterator = queue.iterator();