CPE
The simple-git library fails to block 'trailer.<token>.cmd' configuration in its unsafe-operation guard, enabling command injection when applications process untrusted user input.