pomelo-monitor up to and including 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.
netease pomelo-monitor