Those hurt in the explosion on Victor-Hugo Street, including a girl aged eight, appear to have suffered superficial injuries.
Police are hunting a cyclist who was seen leaving the parcel outside a bakery on a street corner, reports say.
Anti-terrorist prosecutors have taken over the investigation in the country's third-biggest city.
French Interior Minister Christophe Castaner said he had ordered security to be boosted in public places and at major events.
What do we know so far?
The device, which was reportedly full of screws, nuts and bolts, exploded around 17:30 (15:30 GMT) on the street in the historic city centre, between the Saone and Rhone rivers.
Reports say a man aged between 30 and 35 arrived on a bicycle and left the bag. He is said to have been wearing a face mask and dark glasses.
French media quoted a receptionist at a nearby hotel as saying there had been a "deafening blast".
"I saw people running and panicking and heard several cries," Alexis Saillan told BFMTV.
The mayor of Lyon's 2nd Arrondissement, Denis Broliquier, said he was certain the device had been designed to cause injury.
Several witnesses had told him, he said, that the device had been placed in a bag and left by a man filmed by municipal CCTV.
Two metro stations in the city - Ampère Victor Hugo and Bellecour - have been closed, police said.