Merged #166 "Fix XRF vulnerability"