Client code execution is when attacker-influenced code runs on an end-user workstation or application client instead of on a server. The code may be launched through a crafted file, script, plugin, or document feature that the client is expected to interpret. Security flaws in parsers, script handlers, and unsafe input validation can turn ordinary content into executable behavior.
This matters because client systems often have direct user access, cached credentials, and network reach into sensitive environments. In practice, attackers use client code execution to gain a foothold, run commands, write files, or prepare later movement inside a network. Defenders reduce the risk by patching vulnerable clients, restricting file and script features, applying least privilege, and limiting what a workstation can access if it is compromised.