Arbitrary code execution vulnerability

Received this vulnerability report via Snyk: https://security.snyk.io/vuln/SNYK-JAVA-XALAN-2953385

Cybersource imports Xalan, all versions of Xalan are affected. Would be helpful to confirm that Cybersource SDK is not affected by this vulnerability or to patch it.