From 419fc7d09eb5128d3ea1f850d4f8d2963e207636 Mon Sep 17 00:00:00 2001
From: Jacob Ebey <jacob.ebey@live.com>
Date: Tue, 19 Mar 2024 10:20:58 -0700
Subject: [PATCH 1/2] fix: escape single fetch transfer

---
 packages/remix-react/single-fetch.tsx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/remix-react/single-fetch.tsx b/packages/remix-react/single-fetch.tsx
index a016bf190c6..9d90e226b3f 100644
--- a/packages/remix-react/single-fetch.tsx
+++ b/packages/remix-react/single-fetch.tsx
@@ -20,6 +20,7 @@ import { decode } from "turbo-stream";
 
 import { createRequestInit } from "./data";
 import type { AssetsManifest, EntryContext } from "./entry";
+import { escapeHtml } from "./markup";
 import type { RouteModules } from "./routeModules";
 import invariant from "./invariant";
 
@@ -74,8 +75,8 @@ export function StreamTransfer({
   let scriptTag = value ? (
     <script
       dangerouslySetInnerHTML={{
-        __html: `window.__remixContext.streamController.enqueue(${JSON.stringify(
-          value
+        __html: `window.__remixContext.streamController.enqueue(${escapeHtml(
+          JSON.stringify(value)
         )});`,
       }}
     />

From 14428cf23d8d68c482c9a3d7968cd9b300db5269 Mon Sep 17 00:00:00 2001
From: Jacob Ebey <jacob.ebey@live.com>
Date: Tue, 19 Mar 2024 10:43:46 -0700
Subject: [PATCH 2/2] Create shy-buttons-buy.md

---
 .changeset/shy-buttons-buy.md | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .changeset/shy-buttons-buy.md

diff --git a/.changeset/shy-buttons-buy.md b/.changeset/shy-buttons-buy.md
new file mode 100644
index 00000000000..5ef85720043
--- /dev/null
+++ b/.changeset/shy-buttons-buy.md
@@ -0,0 +1,6 @@
+---
+"remix": patch
+"@remix-run/react": patch
+---
+
+fix: escape single fetch transfer