Even works with two dashes, from what I can see. Maybe even one.

Yeah, seems to be there is a case of MD injection here, which if true, might be possible to lead to an MDX injection, at which point your cookies are mine ;-)