“When it comes to JSON, the other thing that I usually say is to use to manipulate JSON objects to use a well-known library that hasn't any known vulnerabilities.”

Transcript evidence from Katy Anton -- OWASP Top 10 #4 XXE.