Is JSON safe to use as a command line argument or does it need to be sanitized first?

Yes. That is dangerous.

JSON can include single quotes in string values (they do not need to be escaped). See "the tracks" at json.org.

Imagine the data is:

{"pwned": "you' & kill world;"}

Happy coding.

---

I would consider piping the data in to the program in question (e.g. use "popen" or even a version of "exec" that passes arguments directly) -- this can avoid issues that result from passing through the shell, for instance. Just as with SQL: using placeholders eliminates the need to trifle with "escaping".

---

If passing through a shell is the only way, then this may be an option (it is not tested, but something similar holds for a "<script>" context):

For every character in the JSON, which is either outside the range of "space" to "~" in ASCII, or has a special meaning in the '' context of a the shell such as \ and ' (but excluding " or any other character -- such as digits -- that can appear outside of "string" data, which is a limitation of this trivial approach), then encode the character using the \uXXXX JSON form. (Per the limitations defined above this should only encode potentially harmful characters appearing within the "strings" in the JSON and there should be no \\ pairs, no trailing \, and no 's, etc.)