evalidate

library2.1.4pypypi✓ verified 85d ago

Evalidate is a Python library for validation and secure evaluation of untrusted Python expressions. Version 2.1.4 is current, with active development on GitHub. It provides an expression evaluator that restricts available nodes (e.g., no imports, no function calls unless whitelisted) to safely evaluate user-provided expressions.

auth-security serialization

pip install evalidate

github ↗package ↗

INSTALL

IMPORT

SIG · EVALIDATE

evalidate

auth-securitypythonv2.1.4

Install

1.5s avg

Import

34ms

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.1.4 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.034s · 17.8MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.5s · import 0.034s · 18MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

evalidate

✓ import evalidate

Direct import of the module is the standard approach.

Basic usage: evaluate a safe expression with the default restrictions.

import evalidate # Safe expression evaluation result = evalidate.eval('1 + 2') print(result) # 3 # Unsafe expression raises # evalidate.eval('__import__("os")') # Raises SecurityError

Debug

Known issues

gotchaevalidate does NOT block all unsafe expressions by default. For example, attribute access on objects is allowed (e.g., 'obj.__class__') unless explicitly restricted. Always configure a whitelist/blacklist for production use.

fix

Use evalidate.Eval with explicit node whitelist: Eval(whitelist=['Expression', 'Num', 'Str', 'Name', 'Load', 'BinOp', ...])

affects: all

breakingIn version 2.1.0, the signature of Eval.eval() changed to accept both local and global context parameters. Code written for older versions using only one context may break.

fix

Update calls to Eval.eval(expr, ctx) to Eval.eval(expr, global_ctx=ctx) or Eval.eval(expr, local_ctx=ctx, global_ctx=ctx) as needed.

affects: <2.1.0

gotchaThe default whitelist includes Is and IsNot nodes (since v2.1.3). This can be surprising if you expected strict equality only.

fix

Remove 'Is' and 'IsNot' from the whitelist if you want to disallow identity comparisons.

affects: >=2.1.3

Errors

Common errors & fixes

AttributeError: module 'evalidate' has no attribute 'security'

The old API evalidate.security was removed in version 2.0.0.

fix

Use evalidate.Eval with whitelist/blacklist instead of evalidate.security.

evalidate.exceptions.SecurityError: Node type 'Call' is blacklisted

The expression contains a function call, which is blacklisted by default.

fix

If you need to allow specific function calls, use a custom whitelist: Eval(whitelist=['Call', ...]) and provide allowed functions via global context.

Upgrade

Version history

2.1.4latest on PyPI · released Mar 2, 2026

Audit

Dependencies

No dependency data recorded yet.

Agent activity

34 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/yaroslaff/evalidate ↗

packagehttps://pypi.org/project/evalidate/ ↗