In GNU Less before 609 crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.

...