A code injection vulnerability exists in datamodel-code-generator prior to version 0.60.1. The flaw resides in Jinja2 templates used to generate Python models from GraphQL Union type definitions. GraphQL Union description values are rendered into Python comments without neutralizing carriage return characters, allowing attacker-controlled GraphQL schema content to inject arbitrary Python code into generated model files. This injected code executes automatically when the generated Python modules are imported. The vulnerability affects two template files: UnionTypeStatement.jinja2 and UnionTypeStatement.py312.jinja2. Exploitation requires an attacker to control or influence the GraphQL schema input provided to the code generator. The issue has been remediated in version 0.60.1 of datamodel-code-generator.