【中文导读】FelixRiddle dev-jobs-handlebars 存在安全缺陷风险（高危风险）。具体受影响版本、触发条件和修复方案以 NVD/厂商公告为准。 【原始描述】FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover.