# Noctalia Wayland shell 5.4.1 patches lock screen bypass and KDE wallpaper injection flaws

> **Key takeaway:** Noctalia 5.4.1 fixes critical D-Bus authentication bypass and command injection vulnerabilities while adding encrypted notification storage and desktop UI improvements.

**Published:** 2026-10-29T19:54:58+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/noctalia-wayland-shell-541-patches-lock-screen-bypass-and-kd.html 

## Summary
Noctalia, a Wayland shell project, shipped version 5.4.1 just three days after its 5.4 release with multiple security fixes, encrypted notification storage, and desktop enhancements. The update addresses an authentication bypass in the lock screen that allowed forged logind unlock and fingerprint-match signals from unauthorized D-Bus senders, plus a related idle-locking weakness where forged signals could suppress automatic screen locking. A separate fix closes command and script injection through maliciously crafted KDE wallpaper filenames containing shell metacharacters.

Beyond security, Noctalia 5.4.1 migrates notification history and image previews to encrypted storage with automatic plaintext migration, adds symbolic icon tinting to the taskbar, compositor blur support for the dock with per-monitor overrides, and expanded screenshot annotation tools with gradient backgrounds and rounded corners. Calendar integration gains per-account sync status, failure diagnostics, and optional event location display with clickable web links.

## Security architecture and desktop changes in Noctalia 5.4.1
- **Lock screen authentication bypass:** The fix rejects forged logind unlock and fingerprint-match signals by validating D-Bus sender authorization, preventing unauthorized processes from spoofing unlock events.
- **Idle locking hardening:** Inhibition states are now read directly from logind rather than trusting signal payloads, eliminating a vector where forged signals could prevent automatic screen locking.
- **KDE wallpaper filename injection:** Malicious filenames containing quotation marks or shell substitutions are now sanitized, closing a command and script injection path through KDE's wallpaper handling.
- **Notification encryption:** Saved notification history and image previews are encrypted with automatic migration of existing plaintext records; stored data persists when encryption keys are temporarily unavailable.
- **Compositor blur and per-monitor overrides:** The dock gains blur effects with per-monitor configuration on compatible Wayland compositors, extending visual customization for multi-display setups.

## Why it matters
For Linux desktop users and distributions adopting Wayland-first environments, these security fixes address concrete attack vectors in session management and file handling that could affect any Noctalia-based deployment. The encrypted notification storage and D-Bus hardening align with broader ecosystem demands for improved session security on Wayland, while the per-monitor blur overrides and screenshot annotation tools reflect continued maturation of desktop shell capabilities competing with established X11 and proprietary alternatives.