JSON poisoning is tampering with trusted JSON data or metadata so software accepts manipulated instructions, settings, or control signals. JSON itself is not dangerous; the risk comes when an application treats remote JSON as authoritative without enough validation, signing, or integrity checks. Common targets include update feeds, manifests, API responses, configuration blobs, and feature flags.
This matters in cyber security because attackers can change behavior without modifying the main source code. A poisoned JSON response may redirect updates, enable unwanted features, weaken security settings, or supply malicious account and plugin metadata. Defenders reduce the risk by signing update data, validating schemas and origins, pinning trusted endpoints, logging changes to control channels, and comparing remote metadata against expected values. In supply-chain environments, protecting the data path can be as important as reviewing code.