CWE-96 is a weakness class for improper neutralization of directives in statically saved code. In practice, it means an application stores data that later gets treated like instructions, queries, templates, or commands without enough sanitization or escaping. That can let attacker-controlled input change how the program behaves.
This matters because it often becomes an injection path on the server side, where a single flaw can affect many users or connected systems. In real attacks, CWE-96-style bugs may lead to code execution, unauthorized configuration changes, or malicious script generation. Defenders look for unsafe concatenation of input into code-like contexts, enforce strict output encoding, and prefer parameterized or structured APIs. Code review, fuzzing, and input validation help catch these weaknesses before they reach production.