Comment by dev_daftly

It's not executing untrusted code, it's calling git when you have a malicious version of git on your system