Fixed in latest Git clients: v2.26.1, v2.25.3, v2.24.2, v2.23.2, v2.22.3, v2.21.2, v2.20.3, v2.19.4, v2.18.3, and v2.17.4. https://lkml.org/lkml/2020/4/14/1136
This is your reminder that there is no such thing as computer security in the year 2020. Treat your computers accordingly.