orbtk (>=0.3.0-alpha-1, <=0.3.1-alpha2), orbtk-api (>=0.3.0-alpha1, <=0.3.1-alpha2) +2 more potentially affected by CVE-2020-36459 via dces (0.2.0)

dces CARGO version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dces and may be impacted: - orbtk =0.3.0-alpha-1, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.0-alpha1, =0.3.1-alpha2 Source cves: CVE-2020-36459 Source advisory: OSV:GHSA-HXW9-JXQW-JC8J...

CVE-2020-36459

The CVE-2020-36459 issue affects the Rust crate dces (World type) where World is marked as Send but lacks bounds on its EntityStore and ComponentStore . This can allow non-thread-safe stores to be sent across threads, potentially causing data races. Documented in multiple sources (e.g., RustSec a...