Git's on disk format has a massive attack surface.

Do not run "git" in untrusted directories. It is not hardened against that (as opposed to the network protocol).

That probably includes libgit2 unless it explicitly states the opposite.