The Wikibase API gives users full control over the FormatterOptions and ParserOptions using the options parameter of the wbformatvalue and wbparsevalue modules, respectively. For instance, you can customize the strings used to format coordinates:
40°25'5.3000"N, 20°29'47.3000"E
wbformatvalue with options {"north": "<script>alert('hi')</script>","degree": "GRAAAAAAD"}
40GRAAAAAAD25'5.3000"<script>alert('hi')</script>, 20GRAAAAAAD29'47.3000"E
I’d like to know if anybody actually specifies options – other than lang, which the Wikibase UI sets by default (even though it’s redundant with uselang, which it also sets). If, as I suspect, nobody makes use of this flexibility, it’s probably best to get rid of it, frankly. (I hope the rest of the team agrees with me, but I’m writing in first person singular not plural just in case ;) )