simple-git versions prior to 3.36.0 are vulnerable to remote code execution due to an incomplete fix for a previous vulnerability. The flaw allows an attacker to bypass restrictions on the -c option by using the equivalent --config form, potentially enabling execution of arbitrary code if untrusted input reaches the options argument. This vulnerability has a critical severity with a CVSS score of 9.8 and is fixed in version 3.36.0.