What version of Go are you using (go version)?

go version go1.16.15 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

$ go env

What did you do?

A simple main.go program:

package main

import (
	"encoding/xml"
	"os"
)

func main() {
	type Person struct {
		Data    string `xml:",cdata"`
	}

	v := &Person{}
	v.Data = "\x1b[1;33mWARN\x1b[0m I dont know what to do"

	output, _ := xml.MarshalIndent(v, "  ", "    ")
	os.Stdout.Write(output)
}

Run and store the output:

$ go run main.go > output.xml

Try validate the xml:

$ xmllint output.xml

What did you expect to see?

encode error, or
no error with invalid character being replaced

What did you see instead?

encode success, but xmllint report parse error

Reference:

• https://www.w3.org/TR/xml/#NT-Char