Today we released a security update for django-hijack that fixes a security vulnerability in the admin (HTML escaping issue).
We recommend to update your projects ASAP. You can get the latest version (1.0.7) from the Github project's release page https://github.com/arteria/django-hijack/releases/tag/v1.0.7 or from PyPI.