Question: is xss possible in json?
Answer: This potential xss vulnerability can be avoided by using the correct Content-Type . Based on RFC-4627 all JSON responses should use the application/json type. ... This would be an RFC violation. If you use JavaScript to eval() the JSON above or write the response to the page then it becomes DOM Based XSS.