{"action":"Upgrade shopper/framework to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"0"}],"component":"shopper/framework","cve_ids":["CVE-2026-56831"],"ecosystem":"Packagist","epss":0.00435,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-5vf4-452p-jjhf","id":"tcs_01M5KEWCZ8HX9ZAMYQBR6DZ7MK","modified_at":"2026-09-11T21:45:09.894168904Z","published_at":"2026-09-11T21:28:00Z","references":["https://osv.dev/vulnerability/GHSA-5vf4-452p-jjhf","https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf","https://github.com/shopperlabs/shopper"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-5vf4-452p-jjhf","url":"https://osv.dev/vulnerability/GHSA-5vf4-452p-jjhf"}],"summary":"Shopper: Negative discount values accepted and propagated through order calculation pipeline"}