The flaw allows an attacker to inject Python code into generated data‑model files by inserting a carriage return in a GraphQL Union type description. The generator places the description directly into Python comments without neutralizing control characters, so a crafted schema can cause the generated model to execute malicious code when it is imported.

The vulnerability exists in koxudaxi's datamodel‑code‑generator in all releases prior to version 0.60.1; any instance of the tool that processes untrusted GraphQL schemas and then imports the generated models is susceptible.

With a CVSS score of 7.8 the risk is moderate to high. The EPSS < 1% indicates that active exploitation is currently rare, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious schema to the generator and subsequently execute the resulting Python module, typically within a build or deployment pipeline. If achieved, an attacker can run arbitrary code with the permissions of the executing process.