django-js-reverse (aka Django JS Reverse) prior to 0.9.1 has XSS via js_reverse_inline.
django js reverse project django js reserve