Lua started out as a configuration language (see the 2007 HOPL III paper) and still includes all required features to represent configuration information (or a data serialization format, as you put it), partly even more elegantly than JSON. And it is also is a programming language, which might raise security concerns when using it in a configuration-only application (where JSON is not critical because it is not a full programming language).