HTML files: getting around CORS (cross-origin)

It’s not the CasparCG issue:

security aside, you can simply add header on server side (that’s where your JSON is generated):
Access-Control-Allow-Origin: *