Local code execution via unqualified Git invocation

Untrusted search path in Python Poetry before 1.1.9 allows context-dependent attackers to execute code when a user runs Poetry on Windows. The Git VCS helper passes the bare name git to subprocess execution, allowing Windows search order to select an attacker-supplied git.exe from the working directory. Exploitation requires malicious content in that directory and a user to invoke a Poetry command; the payload then runs with that user's privileges.