Arbitrary script execution means an attacker can make a target system run code or scripts they influence. The script may be limited to a specific runtime, such as a web server, shell, or automation engine, but it still gives the attacker control over what the system does next.
This matters because execution is often a major step from vulnerability to compromise. In real attacks, it can be reached through input validation bugs, path traversal, command injection, or deserialization flaws. Once scripts run, attackers may steal data, change configuration, deploy backdoors, or pivot deeper into the network. Defenders look for unexpected process launches, unusual script files, and execution from services that should only read data. Preventing it requires strict input handling, least privilege, safe command usage, and rapid patching of exposed management systems.