For configuration files I just put in comments anyway and strip them before feeding the file to a JSON parser. (Like here: https://github.com/creshal/yspave/blob/master/yspave/pave.py... )

Hackish, but beats having to bother with YAML parsers and their regular RCE vulnerabilities.