bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.