It’s been known for decades that you should never put your current directory in your PATH. There are endless opportunities for vulnerabilities then. I learned this in college in the 80’s (by not following it and getting owned).

Yet PowerShell does it by default.

I don't think it does?

   > cd C:\Temp
   > copy "C:\Program Files\Git\bin\git.exe" .\fred.exe
   > fred
   fred: The term 'fred' is not recognized as a name of a cmdlet, function, script file, or executable program.
   Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

If bash placed the current directory in your PATH by default, then yes.

Could file a CVE with Microsoft then, cause thats kinda what cmd.exe is doing:

    > git clone git://evil evil
    > cd evil\
    > git status

The last line would execute git.exe from the cloned repo, wouldn't it?

No, `git` uses the binary in path, to use the repo file it should be `./git.exe`

On Linux.

Look for `NoDefaultCurrentDirectoryInExePath` if you want to learn about Windows.

I would file a CVE for any program that places untrusted content into PATH and invokes non-fully qualified executable names - not for the shell.

Not with bash. If your distro is putting ./ into the path then that's absolutely a high severity CVE with your distro's config.