Dynamic class loading is a runtime feature that lets software load code only when it is needed, rather than at startup. In Java and similar environments, an application may read a class name from configuration, a database connector, or another input and then instantiate that class on the fly.
This is useful for plugins, drivers, and modular systems, but it becomes dangerous when the loaded class name or search path is influenced by an attacker. If input validation is weak, an adversary may redirect the application to unexpected code, trigger unsafe methods, or reach execution inside a privileged server process. Defenders reduce the risk by hard-coding allowed classes, using strict allowlists, avoiding untrusted configuration for code paths, and limiting the privileges of the process that performs the loading.