diff --git a/.changeset/shy-buttons-buy.md b/.changeset/shy-buttons-buy.md
new file mode 100644
index 00000000000..5ef85720043
--- /dev/null
+++ b/.changeset/shy-buttons-buy.md
@@ -0,0 +1,6 @@
+---
+"remix": patch
+"@remix-run/react": patch
+---
+
+fix: escape single fetch transfer
diff --git a/packages/remix-react/single-fetch.tsx b/packages/remix-react/single-fetch.tsx
index a016bf190c6..9d90e226b3f 100644
--- a/packages/remix-react/single-fetch.tsx
+++ b/packages/remix-react/single-fetch.tsx
@@ -20,6 +20,7 @@ import { decode } from "turbo-stream";
 
 import { createRequestInit } from "./data";
 import type { AssetsManifest, EntryContext } from "./entry";
+import { escapeHtml } from "./markup";
 import type { RouteModules } from "./routeModules";
 import invariant from "./invariant";
 
@@ -74,8 +75,8 @@ export function StreamTransfer({
   let scriptTag = value ? (
     <script
       dangerouslySetInnerHTML={{
-        __html: `window.__remixContext.streamController.enqueue(${JSON.stringify(
-          value
+        __html: `window.__remixContext.streamController.enqueue(${escapeHtml(
+          JSON.stringify(value)
         )});`,
       }}
     />