| Severity | warn |
| Confidence | 85 |
| Threat category | injection |
| Default | ON |
| Stable since | 1.1.0 (catch ID reserved; detection logic lands in a follow-up v1.1 phase) |
SET search_path with a user-writable schema before pg_catalog (CVE-2018-1058 pattern) lets an unprivileged role shadow built-in functions and operators for the rest of the session. This is the canonical search-path-injection shape.
This catch ID is reserved as part of the v1.1 Postgres catalog
expansion. The forever-stable ID guarantee in
STABILITY.md applies from the moment this entry
ships in RULE_REGISTRY. Detection logic is being implemented in a
follow-up v1.1 phase; until then the rule is registered as a no-op
placeholder so consumers can already key on the ID.
- libpg-query AST patterns are documented inline in the rule source
at
packages/sdk/src/rules/sql-027-set-search-path.ts.