diff --git a/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py b/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py
index d8b1ed1eb7b..4af86bb6dd1 100644
--- a/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py
+++ b/odoo/addons/test_lint/tests/_odoo_checker_sql_injection.py
@@ -149,6 +149,8 @@ class OdooBaseChecker(BaseChecker):
                 self._is_constexpr(k, args_allowed=args_allowed) and self._is_constexpr(v, args_allowed=args_allowed)
                 for k, v in node.items
             )
+        elif isinstance(node, astroid.Starred):
+            return self._is_constexpr(node.value, args_allowed=args_allowed, position=position)
         elif isinstance(node, astroid.BinOp): # recusively infer both side of the operation. Failing if either side is not inferable
             left_operand = self._is_constexpr(node.left, args_allowed=args_allowed)
             right_operand = self._is_constexpr(node.right, args_allowed=args_allowed)
diff --git a/odoo/addons/test_lint/tests/test_checkers.py b/odoo/addons/test_lint/tests/test_checkers.py
index 2186137dd02..d7abd8f160f 100644
--- a/odoo/addons/test_lint/tests/test_checkers.py
+++ b/odoo/addons/test_lint/tests/test_checkers.py
@@ -418,5 +418,20 @@ class TestSqlLint(TransactionCase):
             a, _ =  return_tuple(var)
             cr.execute(a)#@
         """)
-        with self.assertMessages(): # this should pass
+        with self.assertMessages():
+            checker.visit_call(node)
+        node = _odoo_checker_sql_injection.astroid.extract_node("""
+        def not_injectable5(var):
+            star = ('defined','constant','string')
+            cr.execute(*star)#@
+        """)
+        with self.assertMessages():
+            checker.visit_call(node)
+
+        node = _odoo_checker_sql_injection.astroid.extract_node("""
+        def injectable6(var):
+            star = ('defined','variable','string',var)
+            cr.execute(*star)#@
+        """)
+        with self.assertMessages("sql-injection"):
             checker.visit_call(node)