diff --git a/SOURCES/0244.patch b/SOURCES/0244.patch
new file mode 100644
index 0000000..8f9d636
--- /dev/null
+++ b/SOURCES/0244.patch
@@ -0,0 +1,43 @@
+From d3d55e027b7628c7738d091fe301d8cb639cab24 Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Tue, 28 Jul 2026 05:10:09 +0200
+Subject: [PATCH] fix(base): escape die() message in emergency hook script
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+die() appends its error message to $hookdir/emergency/01-die.sh using
+echo "warn dracut: FATAL: \"$*\"", which is later sourced by
+emergency_shell(). When die() is called with DHCP-controlled data —
+specifically $netroot derived from the DHCP ROOT_PATH option via
+netroot.sh's handler-resolution failure path — a command-substitution
+sequence such as $(cmd) embedded in that data executes as root when
+dracut sources the emergency hook directory.
+
+Replace `echo` with `printf '%q'` to shell-escape the message before
+writing it into the hook script, preventing command injection via
+DHCP-controlled values that reach die() through error paths.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+
+Resolves: RHEL-210935
+---
+ modules.d/99base/dracut-lib.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
+index 89a1d69ad..832435d21 100755
+--- a/modules.d/99base/dracut-lib.sh
++++ b/modules.d/99base/dracut-lib.sh
+@@ -462,8 +462,8 @@ die() {
+     } > /dev/kmsg
+ 
+     {
+-        echo "warn dracut: FATAL: \"$*\"";
+-        echo "warn dracut: Refusing to continue";
++        printf 'warn dracut: FATAL: %q\n' "$*"
++        echo "warn dracut: Refusing to continue"
+     } >> $hookdir/emergency/01-die.sh
+     [ -d /run/initramfs ] || mkdir -p -- /run/initramfs
+ 
+
diff --git a/SOURCES/0245.patch b/SOURCES/0245.patch
new file mode 100644
index 0000000..dabb4bf
--- /dev/null
+++ b/SOURCES/0245.patch
@@ -0,0 +1,59 @@
+From b8f636d1cdcd2de0211cc5a7ad5424deee2a3568 Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Wed, 29 Apr 2026 05:41:21 +0200
+Subject: [PATCH] fix(base): replace eval with safe variable indirection in
+ splitsep and export_n
+
+splitsep: use local nameref to avoid eval injection via single-quote breakout.
+export_n: use ${!var} and printf -v to avoid eval injection via double-quote breakout.
+
+Related: RHEL-210935
+---
+ modules.d/99base/dracut-lib.sh | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/modules.d/99base/dracut-lib.sh b/modules.d/99base/dracut-lib.sh
+index 832435d21..0a0604472 100755
+--- a/modules.d/99base/dracut-lib.sh
++++ b/modules.d/99base/dracut-lib.sh
+@@ -395,12 +395,18 @@ splitsep() {
+ 
+     while [ -n "$str" -a "$#" -gt 1 ]; do
+         tmp="${str%%$sep*}"
+-        eval "$1='${tmp}'"
++        local -n _splitsep_ref="$1"
++        _splitsep_ref="$tmp"
++        unset -n _splitsep_ref
+         str="${str#"$tmp"}"
+         str="${str#$sep}"
+         shift
+     done
+-    [ -n "$str" -a -n "$1" ] && eval "$1='$str'"
++    if [ -n "$str" -a -n "$1" ]; then
++        local -n _splitsep_ref="$1"
++        _splitsep_ref="$str"
++        unset -n _splitsep_ref
++    fi
+     debug_on
+     return 0
+ }
+@@ -1168,15 +1174,13 @@ emergency_shell()
+ }
+ 
+ # Retain the values of these variables but ensure that they are unexported
+-# This is a POSIX-compliant equivalent of bash's "export -n"
+-export_n()
+-{
++export_n() {
+     local var
+     local val
+     for var in "$@"; do
+-        eval val=\$$var
+-        unset $var
+-        [ -n "$val" ] && eval $var=\"$val\"
++        val="${!var}"
++        unset "$var"
++        [ -n "$val" ] && printf -v "$var" '%s' "$val"
+     done
+ }
+ 
diff --git a/SPECS/dracut.spec b/SPECS/dracut.spec
index d72ad11..563eb0f 100644
--- a/SPECS/dracut.spec
+++ b/SPECS/dracut.spec
@@ -5,7 +5,7 @@
 # strip the automatically generated dep here and instead co-own the
 # directory.
 %global __requires_exclude pkg-config
-%define dist_free_release 244.git20260529
+%define dist_free_release 246.git20260728
 
 Name: dracut
 Version: 049
@@ -271,6 +271,8 @@ Patch240: 0240.patch
 Patch241: 0241.patch
 Patch242: 0242.patch
 Patch243: 0243.patch
+Patch244: 0244.patch
+Patch245: 0245.patch
 
 Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
 
@@ -727,6 +729,10 @@ echo '# Since rhel-8.3 dracut moved to use NetworkManager
 add_dracutmodules+=" network-legacy "' > /etc/dracut.conf.d/50-network-legacy.conf
 
 %changelog
+* Tue Jul 28 2026 Pavel Valena <pvalena@redhat.com> - 049-246.git20260728
+- fix(base): escape die() message in emergency hook script
+- fix(base): replace eval with safe variable indirection in
+
 * Fri May 29 2026 Pavel Valena <pvalena@redhat.com> - 049-244.git20260529
 - fix(network-manager): escape DHCP lease values in dhcpopts
 - fix(network-legacy): replace `echo` writes with `printf` to