I had the same idea while looking through the code of Vulcan.js (http://vulcanjs.org/) which is a framework based on Meteor + GraphQL, but it seems they are immune to JSON injection thanks to lower level mongodb schema validation on behalf of Meteor.