collections.NamedTuple is using an assert to prevent exec attacks:

assert ''.join(field_names).replace('_', '').isalpha()     
# protect against exec attack
s

asserts are ignored when Python code is run with the -O or -OO flag. I suggest to replace them.

Or you could just not have the security protection in there.  I am sure there are a ton of other places that are not protected against malicious use of exec.

It's less than a ton (how do I weight source code? *g*) but it's used in some modules. Personally I don't like the usage of exec/execfile and I'm always worried when I see code that utilizes it. I've created a patch that checks typename and field_names for non alphanumeric characters.

Bastion.py:    exec testcode
bdb.py:                exec cmd in globals, locals
cgi.py:            exec "testing print_exception() -- <I>italics?</I>"
code.py:            exec code in self.locals
collections.py:    exec template in m
cProfile.py:            exec cmd in globals, locals
doctest.py:                exec compile(example.source, filename, "single",
hashlib.py:            exec funcName + ' = f'
hashlib.py:                exec funcName + ' = __get_builtin_constructor(funcName)'
ihooks.py:            exec code in m.__dict__
imputil.py:                exec code in module.__dict__
pdb.py:            exec code in globals, locals
profile.py:            exec cmd in globals, locals
rexec.py:        exec TEMPLATE % (m, m)
rexec.py:        exec code in m.__dict__
runpy.py:    exec code in run_globals
site.py:                exec line
socket.py:        exec _s % (_m, _m, _m, _m)
timeit.py:            exec code in globals(), ns
timeit.py:                    exec _setup in globals(), ns
trace.py:            exec cmd in dict, dict
trace.py:            exec cmd in globals, locals


File Added: NamedTuple_55472.diff

Will replace the assertion with something that always executes.

Fixed.  See revision:   55487

You forgot two things:

 * check for isalnum() instead of isalpha() to allow numbers in type and field names. The current check disallows Point = NamedTuple('Point3', 'x1 x2 x3')
 * add unit tests to verify that a value error is raised

Fixed.