What it asks for. This category covers flaws where untrusted data is sent to an interpreter as part of a command or query, so that an attacker can change its meaning. Examples include SQL, NoSQL, OS command, LDAP and expression language injection. In the 2021 edition, cross-site scripting was merged into this category.
In practice. Applications use safe APIs such as parameterised queries, avoid building commands from strings, validate input against allow lists and encode output for the context it is used in. Static and dynamic testing in the pipeline catches regressions. Evidence includes secure coding standards, code review findings, test results and tracked remediation of injection issues.
Common gaps. Legacy code and internal tools often still build queries by concatenation. Second order injection, where stored data is later used unsafely, and injection in less common interpreters are frequently missed.