[dev_daftly]

It's not executing untrusted code, it's calling git when you have a malicious version of git on your system

[jeremyjh]

No, read the report. It will call an executable called git.exe in the untrusted repo.