Hacker News Reader

Nitpick: This isn't an RCE. An attacker would need 1) write access to a /local/ directory that the target will navigate to in his shell, and 2) convince the target to execute arbitrary git hooks in every directory (or parent directory) he visits by adding git to his shell's PS prompt.

Besides, now that this security issue is patched, git devs should seek a proper solution to that doesn't break git and decrease security for everyone else.

This isn't an RCE, you need to have control over the parent directory first which usually implies some sort of admin privileges already

This is just one way to fix the vulnerability. There are others, with different tradeoffs.