In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
The MITRE CVE dictionary describes this issue as:
In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.