CVE-2020-36204
Data races in im
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
- Record
CVE-2020-36204- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
- Record
CVE-2020-36204- Updated
- 2026-11-02
EUVDEUVD-2021-1838 No score
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
- Record
EUVD-2021-1838- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9h2-4xhf-23xx
Data races in im
An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
- Record
GHSA-q9h2-4xhf-23xx- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-662
- Updated
- 2026-11-02
OSVGHSA-q9h2-4xhf-23xx
Data races in im
An issue was discovered in the im crate prior to 15.1.0 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
- Record
GHSA-q9h2-4xhf-23xx- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-662
- Updated
- 2026-11-02
OSVRUSTSEC-2020-0096
TreeFocus lacks bounds on its Send and Sync traits
Affected versions of im contains TreeFocus that unconditionally implements Send and Sync.
This allows a data race in safe Rust code if TreeFocus is extracted from Focus type.
Typical users that only use Focus type are not affected.
- Record
RUSTSEC-2020-0096- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
imcrates.io |
12.0.0 up to 15.1.0 | 15.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-36204 is a medium vulnerability (CVSS 4.7) in Im Project Im, published November 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in im 15.1.0.
References
rustsec.org/advisories/RUSTSEC-2020-0096.html
nvd.nist.gov/vuln/detail/CVE-2020-36204
github.com/bodil/im-rs/issues/157
crates.io/crates/im