From 283df543b99f9f826146efc28e970267a1543473 Mon Sep 17 00:00:00 2001
From: Jacob Ebey <jacob.ebey@live.com>
Date: Tue, 19 Mar 2024 10:44:01 -0700
Subject: [PATCH] fix: escape single fetch transfer (#9084)

---
 .changeset/shy-buttons-buy.md         | 6 ++++++
 packages/remix-react/single-fetch.tsx | 5 +++--
 2 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/shy-buttons-buy.md

diff --git a/.changeset/shy-buttons-buy.md b/.changeset/shy-buttons-buy.md
new file mode 100644
index 00000000000..5ef85720043
--- /dev/null
+++ b/.changeset/shy-buttons-buy.md
@@ -0,0 +1,6 @@
+---
+"remix": patch
+"@remix-run/react": patch
+---
+
+fix: escape single fetch transfer
diff --git a/packages/remix-react/single-fetch.tsx b/packages/remix-react/single-fetch.tsx
index a016bf190c6..9d90e226b3f 100644
--- a/packages/remix-react/single-fetch.tsx
+++ b/packages/remix-react/single-fetch.tsx
@@ -20,6 +20,7 @@ import { decode } from "turbo-stream";
 
 import { createRequestInit } from "./data";
 import type { AssetsManifest, EntryContext } from "./entry";
+import { escapeHtml } from "./markup";
 import type { RouteModules } from "./routeModules";
 import invariant from "./invariant";
 
@@ -74,8 +75,8 @@ export function StreamTransfer({
   let scriptTag = value ? (
     <script
       dangerouslySetInnerHTML={{
-        __html: `window.__remixContext.streamController.enqueue(${JSON.stringify(
-          value
+        __html: `window.__remixContext.streamController.enqueue(${escapeHtml(
+          JSON.stringify(value)
         )});`,
       }}
     />