TransformerFactory is a Java XML Processing API used to create XSLT transformers. In practice, it is the component that turns XML and XSLT stylesheets into transformation logic, often inside applications that import, validate, or rewrite structured data.
It matters in security because XML transformers can become dangerous if they process untrusted input with insecure defaults. If a TransformerFactory is not hardened, an attacker may abuse XSLT features to read local files, reach internal resources, or trigger XML External Entity-style behavior through related parser settings. Defenders should disable external entity access, restrict stylesheet sources, and apply secure processing options so the transformer only handles trusted content and approved resources.