What can malicious postgres db user do to a linux server?

Suppose I created a db user with create role myuser login password 'xyz'; and allowed typical read and write db permissions. If a malicious user finds these login credentials (and has access to db), what is the worst he can do to the Ubuntu server where the db lives? (e.g. can he get access to the OS shell? can he install something? can he remove non-db files? ...)