Currently:

https://github.com/human made/Custom-Meta-Boxes/blob/ea108de07d0682157124e1786a612351fb0972f6/classes.fields.php#L1180

This should be sufficient escaping... Except that it it is possible that the value of the ajax_url property could be changed before it is output?