“This vulnerability affects users working on multi-user machines where a malicious actor could create a .git directory in a shared location above a victim’s current working directory.”
Git walked up the directory tree looking for a .git folder and trusted whatever it found. On Windows an attacker could just create one at the root of C:. Anyone who could write to a parent directory could run code as you. The fix is to stop trusting directories you don’t own, which should have been the default all along.