On github, any person (let's call them Alice) can fork a project, make modifications to it, and then submit those changes to the project owner(Bob) as a pull request, and the idea is that Bob reviews the submitted code to make sure it is up to spec, and contains no viruses*.
If Bob wants changes made before accepting the pull request (such as code style), they can make comments asking Alice to make those changes, and Alice will most likely make those changes, and commit them to Alice's fork, at which point the commits automatically appear as part of the pull request.
Now, what if there is a malicious person (Malice) that creates a fork with beneficial changes and submits a pull request, and Malice knows exactly when Bob is going to look at that pull request, and that Bob is going to take approximately 5 minutes to look over the new code. Would it then be possible for Malice to make a malicious commit in between Bob requesting the page to view the pull request and Bob pressing the "Accept" button?
*Ideally, this is what happens. We assume Bob is both benevolent and intelligent, and does this properly to his best ability, but is unaware of this particular possible vulnerability.