diff --git a/scrapy/http/request/rpc.py b/scrapy/http/request/rpc.py
index bde860a66..2bf5ba4b6 100644
--- a/scrapy/http/request/rpc.py
+++ b/scrapy/http/request/rpc.py
@@ -7,9 +7,13 @@ See documentation in docs/topics/request-response.rst
 import xmlrpc.client as xmlrpclib
 from typing import Any, Optional
 
+from defusedxml import xmlrpc
+
 from scrapy.http.request import Request
 from scrapy.utils.python import get_func_args
 
+xmlrpc.monkey_patch()
+
 DUMPS_ARGS = get_func_args(xmlrpclib.dumps)
 
 
diff --git a/setup.py b/setup.py
index 405633f55..2d6d26b0c 100644
--- a/setup.py
+++ b/setup.py
@@ -22,6 +22,7 @@ install_requires = [
     "packaging",
     "tldextract",
     "lxml>=4.4.1",
+    "defusedxml>=0.7.1",
 ]
 extras_require = {
     ':platform_python_implementation == "CPython"': ["PyDispatcher>=2.0.5"],