Arbitrary Code Execution

github.com/git-lfs/git-lfs is vulnerable to Arbitrary Code Execution. The vulnerability is due to Go preferring the current directory when the name of a command run does not contain a directory separator, in the case of Windows. This can result in arbitrary code execution if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory resulting in Arbitrary Code Execution. This vulnerability is only exploitable on Windows.