diff --git a/src/pkg/xml/xml.go b/src/pkg/xml/xml.go
index cd67f6e2657..29fc739497f 100644
--- a/src/pkg/xml/xml.go
+++ b/src/pkg/xml/xml.go
@@ -790,7 +790,7 @@ Input:
 		if quote >= 0 && b == byte(quote) {
 			break Input
 		}
-		if b == '&' {
+		if b == '&' && !cdata {
 			// Read escaped character expression up to semicolon.
 			// XML in all its glory allows a document to define and use
 			// its own character names with <!ENTITY ...> directives.
diff --git a/src/pkg/xml/xml_test.go b/src/pkg/xml/xml_test.go
index 148bd2cd0c5..c1688088e6c 100644
--- a/src/pkg/xml/xml_test.go
+++ b/src/pkg/xml/xml_test.go
@@ -387,3 +387,14 @@ func TestTrailingToken(t *testing.T) {
 		t.Fatalf("p.Token() = _, %v, want _, os.EOF", err)
 	}
 }
+
+func TestEntityInsideCDATA(t *testing.T) {
+	input := `<test><![CDATA[ &val=foo ]]></test>`
+	p := NewParser(StringReader(input))
+	var err os.Error
+	for _, err = p.Token(); err == nil; _, err = p.Token() {
+	}
+	if err != os.EOF {
+		t.Fatalf("p.Token() = _, %v, want _, os.EOF", err)
+	}
+}