How to Parse Mexico's CFDI 4.0 XML in C# Without Common Pitfalls

Electronic invoicing in Mexico requires reading CFDI XML files for tasks like payment reconciliation and ERP integration, but the process involves several non-obvious technical traps. A key security concern is disabling DTD processing before loading any external XML, since CFDI files from third parties can carry XXE attacks or entity expansion vulnerabilities. Developers must also account for namespace differences between CFDI 4.0 and the still-circulating 3.3 format, as element lookups silently return null when the namespace is ignored. The fiscal folio UUID is not a root attribute but lives inside a separate TimbreFiscalDigital complement with its own namespace, requiring nested element traversal. Additionally, VAT-exempt line items omit the Importe attribute entirely, so parsing tax amounts without a null check will crash on the first exempt invoice received.