Right now the API for adding CDATA only allow to define the tags where to add them, and by default it's using script and style. However, it's a problem for cleaning application/json scripts, as it produces invalid JSON: CDATA is indeed produced with a comment and JSON cannot contain comments.
Ideally the API should be able to define filters for ignoring where specifically to add CDATA. Now by default it should probably ignore any script tags that targets application/json type.
I tried to work on that issue, I think I actually made too much changes: in particular I saw that XmlSerializer#dontEscape is used both for knowing if the content needs to be escaped and to know if CDATA should be added, which is a problem here as we still don't want to escape the content even without a CDATA.
So I think same problem might apply to DomSerializer, in which case my code is probably wrong and I might miss adding a unit test somewhere.