GHSA-6v8j-6w28-2w8r: 
JavaScript vulnerability analysis and mitigation

Impact

Workflow scripts run inside a node:vm context in a worker thread. Values the runtime hands to the script (runs, emit, console, the Promise wrapper, results and errors from runs.*) were created in the worker's realm, so a script could reach the worker's unrestricted Function constructor and from there process, child_process and fs. Workflow scripts are usually written by the model, so a prompt-injected model could run arbitrary commands as the user, bypassing the workflow shell-command deny, worktree/cwd limits and agent allow-lists.

Patches

Fixed in 0.84.0: the script-facing runtime is built inside the script context and only strings cross the boundary.

Workarounds

Add "disabledFeatures": ["workflow-scripts"] to your pi-subagents settings until you upgrade. Top-level chain and tasks keep working.