Eco's default __escape implementation doesn't escape single quotes, which makes XSS attacks like the following possible:

<input type='text' value='<%= @value %>'>

with a @value of x'onmouseover='alert(document.domain), an XSS occurs.

This fork fixes the issue by using Underscore's escape.