Description should be html safe as the only values that it can contain are retrieved from docstrings.

rest_framework/templates/rest_framework/base.html

@@ -110,7 +110,7 @@
 
         <div class="content-main">
             <div class="page-header"><h1>{{ name }}</h1></div>
-            {{ description }}
+            {{ description|safe }}
             <div class="request-info" style="clear: both" >
                 <pre class="prettyprint"><b>{{ request.method }}</b> {{ request.get_full_path }}</pre>
             </div>