Impact

What kind of vulnerability is it? Who is impacted?

It is possible to inject and run code within the template if the attacker has access to write the template name.

const { template } = require('@blakeembrey/template');

template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned");

Patches

Has the problem been patched? What versions should users upgrade to?

Upgrade to 1.2.0.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Don't pass untrusted input as the template display name, or don't use the display name feature.

References

Are there any links users can visit to find out more?

Fixed by removing in b8d9aa9.