It's not hard to find quite recent json parsing vulnerabilities, e.g.

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-b...

A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year:

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json

Here is a nice blog post walking through various JSON based exploits:

https://bishopfox.com/blog/json-interoperability-vulnerabili...