María is a ghost story told as a slow, sad ballad, and Café Tacvba play it straight with no wink.
María goes out alone at night ("Sale sola de noche María" [María goes out alone at night]) and wanders the city. The verb they use for that is penar, and here it does not just mean to grieve: in Mexican folklore an alma en pena is a soul in torment that cannot rest, so María is wandering the streets where she once "negó besos en la oscuridad" [refused kisses in the dark]. Her eyes cloud over because it hurts to remember that those refused kisses "nunca más regresarán" [will never come back].
Then the song turns creepy. Walk that road at night and "algo extraño puede pasar" [something strange can happen]: you feel the cold of other lips on yours. Under a street lamp ("debajo de un farol") she "roba besos y vida a la gente" [steals kisses and life from people] while her body "yace en un cajón" [lies in a coffin]. Cajón literally means a drawer or box, and it is everyday Mexican slang for a coffin. The last two lines are the best part: "María bonita, María marchita" [pretty María, withered María]. Bonita and marchita rhyme, and the second one is what you call a dead flower.