grape subject to Cross-site Scripting

The grape rubygem suffers from a cross-site scripting XSS vulnerability via "format" parameter...