From fc534ffe81edb6b0e9bd3e97037eedf4a4ea2ebd Mon Sep 17 00:00:00 2001
From: Chirag Bitoni <chiragbitoni4994@gmail.com>
Date: Sun, 8 Nov 2026 15:37:51 +0530
Subject: [PATCH] fix: reject raw ']]>' in element character data (#901)

Signed-off-by: Chirag Bitoni <chiragbitoni4994@gmail.com>
---
 spec/validator_spec.js | 11 +++++++++++
 src/validator.js       |  2 ++
 2 files changed, 13 insertions(+)

diff --git a/spec/validator_spec.js b/spec/validator_spec.js
index 0d07e227..60869857 100644
--- a/spec/validator_spec.js
+++ b/spec/validator_spec.js
@@ -378,6 +378,17 @@ attribute2="attribute2"
         validate('<rootNode>jekyll &abcdefghij1234567890;</rootNode>');
         validate('<rootNode>jekyll &abcdefghij1234567890a;</rootNode>', error); // limit to 20 chars
     });
+
+    it("should not validate XML with raw ']]>' in element text", function () {
+        const error = {
+            InvalidChar: "char ']]>' is not expected."
+        };
+        validate("<a>]]></a>", error, 1, 4);
+        validate("<root>hello ]]> world</root>", error, 1, 13);
+        validate("<a><![CDATA[inside]]>after]]></a>", error, 1, 27);
+        validate("<a>]]&gt;</a>");
+        validate("<a attr=']]>'>ok</a>");
+    });
 });
 
 describe("should not validate XML documents with multiple root nodes", () => {
diff --git a/src/validator.js b/src/validator.js
index 6f9904f0..2309aa5e 100644
--- a/src/validator.js
+++ b/src/validator.js
@@ -159,6 +159,8 @@ export function validate(xmlData, options) {
             if (afterAmp == -1)
               return getErrorObject('InvalidChar', "char '&' is not expected.", getLineNumberForPosition(xmlData, i));
             i = afterAmp;
+          } else if (xmlData[i] === ']' && xmlData[i + 1] === ']' && xmlData[i + 2] === '>') {
+            return getErrorObject('InvalidChar', "char ']]>' is not expected.", getLineNumberForPosition(xmlData, i));
           } else {
             if (reachedRoot === true && !isWhiteSpace(xmlData[i])) {
               return getErrorObject('InvalidXml', "Extra text at the end", getLineNumberForPosition(xmlData, i));