Defenses: Input is embedded inside a JSON object in a <script> block. Angle brackets are Unicode-escaped (\u003c). CSP blocks inline scripts without the nonce.
Your input is placed inside a JSON object within a trusted script block. Can you break out of the JSON value?
CONCEPT: JSON Injection in Script Blocks
Many web applications embed server-side data into pages using inline <script> blocks with JSON: var config = {"name": "USER_INPUT"};. Developers often focus on preventing HTML tag injection (encoding < and >) but forget that the attacker is already inside a JavaScript execution context. If the attacker can inject an unescaped ", they break out of the JSON string and can inject arbitrary JavaScript — all within the same trusted script block. This bypasses CSP because the injected code runs inside an already-allowed <script> tag. The fix: JSON.stringify() with proper escaping of ", \, and line terminators, or better yet, use data-* attributes instead of inline JSON.
Submit a name for the config.