I am loading data from an external website which I expect to be in JSON format (but in general that might not be guaranteed). I am using the Python requests library to load this data. I then convert this data to json and to dictionary which is subsequently saved into a database. The code looks like the following:

...
response = requests.get("www.xyz.com").json()
data = dict(response=response)
...

Around this code block there is a try except block so the program handles instances where the requests library fails to parse correct JSON for example. I am worried about possible code injection attacks.

Is it possible for the website www.xyz.com to inject malicious code with a malicious response (for example due the .json() or the dict() function executing something while parsing the response)? I am using pymongo to store the data dictionary in a mongo database later on. The data is later retrieved for analysis and assumed to be safe by subsequent programs.

Thanks a lot for your input!