SigNoz 0.130.1 contains a SQL injection flaw (CWE-89) that allows authenticated attackers to inject URL-encoded quotes into the rule ID path parameter used by its alert‑history endpoints. The unsanitized rule ID is directly interpolated into ClickHouse queries, enabling attackers to execute arbitrary queries that can read all stored traces, logs, and metrics or abuse the url() function to perform server‑side request forgery. The impact is irreversible data disclosure and potential manipulation of stored information.

All installations of the SigNoz Signoz product up to and including version 0.130.1 are affected, as the vulnerability exists in the core backend handling of the alert‑history API.

The CVSS score of 8.3 reflects a critical risk, and since an authenticated user is required, the EPSS score is not provided but the actual risk remains high. The vulnerability is not listed in CISA KEV, but the lack of a public exploit does not reduce the impact of a successful attack. Attackers must craft a request to the alert‑history endpoint with a malicious rule ID; the attack path is purely web‑based and would be successful against any exposed instance of the affected product.