rsvg-base.c:rsvg_set_xml_parse_options() has this:

    /* if false, external entities work, but internal ones don't. if true, internal entities
       work, but external ones don't. favor internal entities, in order to not cause a
       regression */
    xml_parser->replaceEntities = TRUE;

where xml_parser is an xmlParserCtxPtr from libxml2.

We shouldn't be poking into that structure directly.  Instead, we should pass XML_PARSE_NOENT in the options which that function sets.  However, setting that option instead of poking at the structure makes the test suite fail.  This needs investigation.