Are there any injection vulnerabilities in JSON?
If you would do the thing you're describing, nothing would happen, as json is being escaped (if you're using parser (JS object -> JSON))
Nothing would happen in browser environment, but if JSON would be sent over internet as plain text and parsed again?
If you're parsing string version (JSON) to JS object, all values are unesecaped, so you have to escape them afterwards.