In older versions, HTML autoescaping was disabled in a portion of the
template for the technical 500 debug page. Given the right
circumstances, this allowed a cross-site scripting attack. This
vulnerability shouldn't affect most production sites since you shouldn't
run with ``DEBUG = True`` (which makes this page accessible) in your
production settings.

Affected versions
=================

* Django master development branch
* Django 1.11
* Django 1.10

Django 1.8 is unaffected and Django 1.9 reached end-of-life in April 2017.