Code injection is a form of attack in which a malicious user:

Code injection attacks occur when an attacker inserts malicious text into a data field - such as a form input or URL parameter - that the application then passes to an interpreter and executes as code. Classic examples include SQL injection, where a query string is injected into a database input field, and OS command injection. The root cause is insufficient input validation and failure to separate code from data.

Exploiting a buffer overflow to run arbitrary code is a memory corruption exploit, which is a separate attack class from code injection.

Inserting malicious code into JavaScript running in the browser describes cross-site scripting (XSS), not generic code injection.

Gaining access to a server codebase to insert code describes a supply chain or unauthorized access attack, not code injection.