> For the complete documentation index, see [llms.txt](https://zokyo-auditing-tutorials.gitbook.io/zokyo-tutorials/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zokyo-auditing-tutorials.gitbook.io/zokyo-tutorials/tutorial-31-nft-json-and-xss-injection.md).

# Tutorial 31: NFT JSON and XSS injection

{% hint style="info" %}
[**Book an audit with Zokyo**](https://www.zokyo.io/)
{% endhint %}

#### Introduction to JSON Injection Vulnerabilities in tokenURI Functions

In Solidity-based protocols, the `tokenURI` function is commonly used to return metadata for non-fungible tokens (NFTs). This metadata is often formatted as JSON, containing important information such as the token's name, description, and image. However, improperly handling user input or failing to sanitize data can expose smart contracts to **JSON injection vulnerabilities**. These vulnerabilities allow malicious actors to manipulate the JSON data structure, potentially leading to security breaches such as identity spoofing, cross-site scripting (XSS) attacks, or misleading data representation.

This section will explore how these vulnerabilities arise and detail the risks associated with improper handling of JSON in smart contracts, especially in systems that rely on user-generated content or third-party applications.