“Curl said that this is a Windows feature and there are no plans to fix it.”
Windows silently swaps look-alike Unicode characters for ASCII. That turns into argument injection and RCE in PHP, Excel, Subversion, and more. Microsoft marked some reports Won’t Fix and curl calls it a Windows feature. Microsoft’s own curl.exe is patched. The official curl binaries are not.