datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered int…

A code injection vulnerability exists in datamodel-code-generator versions 0.14.1 through 0.60.2. The --extra-template-data comment field is rendered into Python comments across multiple Jinja2 templates without neutralizing carriage returns. This allows an attacker-controlled comment value to break out of Python comments and inject arbitrary Python code into generated data models. The injected code executes automatically when the generated model files are imported. Affected templates include TypeAliasAnnotation, TypedDict, dataclass, msgspec.Struct, and both pydantic v1 and v2 BaseModel templates. The vulnerability poses a significant supply chain risk as generated code may be distributed and imported by downstream users. The issue has been patched in version 0.60.2 with proper carriage return neutralization. Users are strongly advised to upgrade and regenerate any previously generated model files.