diff --git a/SOURCES/0118.patch b/SOURCES/0118.patch
new file mode 100644
index 0000000..a5f737c
--- /dev/null
+++ b/SOURCES/0118.patch
@@ -0,0 +1,41 @@
+From 626ec6752ec5eb6902c2a2424f58b8873b34c7a0 Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Tue, 28 Jul 2026 05:10:09 +0200
+Subject: [PATCH] fix(base): escape die() message in emergency hook script
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+die() appends its error message to $hookdir/emergency/01-die.sh using
+echo "warn dracut: FATAL: \"$*\"", which is later sourced by
+emergency_shell(). When die() is called with DHCP-controlled data —
+specifically $netroot derived from the DHCP ROOT_PATH option via
+netroot.sh's handler-resolution failure path — a command-substitution
+sequence such as $(cmd) embedded in that data executes as root when
+dracut sources the emergency hook directory.
+
+Replace `echo` with `printf '%q'` to shell-escape the message before
+writing it into the hook script, preventing command injection via
+DHCP-controlled values that reach die() through error paths.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+
+Resolves: RHEL-210939
+---
+ modules.d/99base/dracut-lib.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
+index 43b023e14..b1ea95255 100755
+--- a/modules.d/99base/dracut-lib.sh
++++ b/modules.d/99base/dracut-lib.sh
+@@ -451,7 +451,7 @@ die() {
+     } > /dev/kmsg
+ 
+     {
+-        echo "warn dracut: FATAL: \"$*\""
++        printf 'warn dracut: FATAL: %q\n' "$*"
+         echo "warn dracut: Refusing to continue"
+     } >> $hookdir/emergency/01-die.sh
+     [ -d /run/initramfs ] || mkdir -p -- /run/initramfs
+
diff --git a/SOURCES/0119.patch b/SOURCES/0119.patch
new file mode 100644
index 0000000..f2c9cd7
--- /dev/null
+++ b/SOURCES/0119.patch
@@ -0,0 +1,59 @@
+From 3acddfd4cb6663e7caebec2ef60842fada1f997d Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Wed, 29 Apr 2026 05:41:21 +0200
+Subject: [PATCH] fix(base): replace eval with safe variable indirection in
+ splitsep and export_n
+
+splitsep: use local nameref to avoid eval injection via single-quote breakout.
+export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.
+
+(cherry picked from commit efa38e72f2742456dc93060fb1ac28d98217ac21)
+
+Related: RHEL-210939
+---
+ modules.d/99base/dracut-lib.sh | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
+index b1ea95255..1c753ba16 100755
+--- a/modules.d/99base/dracut-lib.sh
++++ b/modules.d/99base/dracut-lib.sh
+@@ -374,12 +374,18 @@ splitsep() {
+ 
+     while [ -n "$str" -a "$#" -gt 1 ]; do
+         tmp="${str%%$sep*}"
+-        eval "$1='${tmp}'"
++        local -n _splitsep_ref="$1"
++        _splitsep_ref="$tmp"
++        unset -n _splitsep_ref
+         str="${str#"$tmp"}"
+         str="${str#$sep}"
+         shift
+     done
+-    [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
++    if [ -n "$str" -a -n "$1" ]; then
++        local -n _splitsep_ref="$1"
++        _splitsep_ref="$str"
++        unset -n _splitsep_ref
++    fi
+     debug_on
+     return 0
+ }
+@@ -1016,14 +1022,13 @@ emergency_shell() {
+ }
+ 
+ # Retain the values of these variables but ensure that they are unexported
+-# This is a POSIX-compliant equivalent of bash's "export -n"
+ export_n() {
+     local var
+     local val
+     for var in "$@"; do
+-        eval val=\$$var
+-        unset $var
+-        [ -n "$val" ] && eval "$var=\"$val\""
++        val="${!var}"
++        unset "$var"
++        [ -n "$val" ] && printf -v "$var" '%s' "$val"
+     done
+ }
+ 
diff --git a/SPECS/dracut.spec b/SPECS/dracut.spec
index c7be2e3..40cf464 100644
--- a/SPECS/dracut.spec
+++ b/SPECS/dracut.spec
@@ -5,7 +5,7 @@
 # strip the automatically generated dep here and instead co-own the
 # directory.
 %global __requires_exclude pkg-config
-%define dist_free_release 117.git20260625
+%define dist_free_release 120.git20260728
 
 Name: dracut
 Version: 057
@@ -140,6 +140,8 @@ Patch111: 0111.patch
 Patch113: 0113.patch
 Patch114: 0114.patch
 Patch116: 0116.patch
+Patch118: 0118.patch
+Patch119: 0119.patch
 
 Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
 
@@ -596,6 +598,10 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/
 %{_prefix}/lib/kernel/install.d/51-dracut-rescue.install
 
 %changelog
+* Tue Jul 28 2026 Pavel Valena <pvalena@redhat.com> - 057-120.git20260728
+- fix(base): escape die() message in emergency hook script
+- fix(base): replace eval with safe variable indirection in
+
 * Thu Jun 25 2026 Pavel Valena <pvalena@redhat.com> - 057-117.git20260625
 - revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless