In JavaScript, it is common to send and receive JSON to servers. For example with the built in fetch() API. When doing so, you can automatically parse the response, as shown in Listing 7.

JSON scripts automatically execute in any webpage that's requested by a web browser. Consequently, they can be used to implement JavaScript insertion attacks against a web client, like a command ...