Sinatra Cross-site Scripting vulnerability

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception...