CWE-95 describes improper neutralization of directives in dynamically evaluated code. In plain terms, a program takes input from a user or another external source and feeds it into an eval-style path, where that input can be interpreted as instructions instead of data. If the input is not strictly validated and escaped, an attacker may inject commands or expressions that the application executes.
This weakness matters because it can turn a small input-handling bug into remote code execution, especially in web applications, plugins, or template engines. In real attacks, CWE-95 often appears when parameters reach dynamic math, expression parsing, template rendering, or scripting features. Defenders reduce risk by avoiding runtime evaluation of untrusted input, using safe parsers, enforcing allowlists, and limiting interpreter privileges. Security reviews should flag any code path where external data can influence executable expressions.