Bumped to v0.9.3.1, cross-site scripting eliminated