A specially malformed repository may have caused Git subrepositories to run arbitrary code (CVE-2017-17458).