When using episerver with WebApi - it enable api controller for Reflected Cross site scripting (XSS) vulnerability.

When access resource via '/api/mycontroller/? <script>alert('hi');</script> '

result in 

Reflected Cross site scripting (XSS) vulnerability. in response.

Note that the script tags are in the xml\JSON source.

If I drop the question mark, /api/mycontroller/. I'm getting correct HttpException.

"A potentially dangerous Request.Path value was detected from the client (<)."></).">

Doesn it due to default Episerver routes configuration, is any way to prevent this?  It's only happen when using webapi with Episerver

Default Route 

Routes.MapHttpRoute(
    "DefaultApi", 
    "api/{controller}/{id}", 
     new { id = RouteParameter.Optional 
});

Controller 

public class DefaultAPIController : ApiController
{
	
	public IEnumerable Get()
	{
		return new string[] { "value1", "value2" };
	}

}

[Pasting files is not allowed]