You could pull the app after confirming that the vulnerability exists and collecting evidence. Or tell the vendor that it's there:

http://twitter.com/0xcharlie/statuses/133901782169550848