{"success":true,"data":{"id":"csrf-via-email-html","label":"Hidden form with auto-submit in email (CSRF attack)","description":"Email HTML contains a <form> with an external action URL AND an auto-submit trigger (onload handler or <script> tag). This is a Cross-Site Request Forgery (CSRF) attack — when the email is rendered, the form auto-submits using the victim's browser session cookies, potentially performing actions on external sites without consent.","tier":"danger","category":"other","isThin":false}}