All the vulnerabilities related to the version 1.0.0 of the package
@blakeembrey/template vulnerable to code injection when attacker controls template input
It is possible to inject and run code within the template if the attacker has access to write the template name.
const { template } = require('@blakeembrey/template');
template("Hello {{name}}!", "exploit() {} && ((()=>{ console.log('success'); })()) && function pwned");
Upgrade to 1.2.0.
Don't pass untrusted input as the template display name, or don't use the display name feature.
Fixed by removing in https://github.com/blakeembrey/js-template/commit/b8d9aa999e464816c6cfb14acd1ad0f5d1e335aa.