That's the same XSS vulnerability that I came to report. Here is a simplified test case:

    {"name":"<b>HELLO</b>"}