≤ 2.0.0
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.