A code injection payload is malicious code inserted into an application to execute unauthorized commands or actions, often exploiting vulnerabilities in input handling.