In Chris Walz bit prior to 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository.
bit project bit