Those hurt, including a girl aged eight, appear to have suffered superficial injuries.Anti-terrorist prosecutors have taken over the investigation and security has been boosted in public places.
Police released a grainy image of the suspect taken from CCTV footage.
They said he was wearing a long-sleeved dark top and light-coloured shorts.
A police source told AFP news agency the suspect appeared to be about 30 and was using a black mountain bike.
What do we know so far?The device, which was reportedly full of screws, nuts and bolts, exploded around 17:30 (15:30 GMT) on Victor-Hugo Street, in the historic city centre, between the Saone and Rhone rivers.
French media quoted a receptionist at a nearby hotel as saying there had been a “deafening blast”.
“I saw people running and panicking and heard several cries,” Alexis Saillan told BFMTV.
The last time a parcel bomb had exploded in France was in 2007 when a device killed one person and injured another in front of a law office in Paris, AFP news agency reports. Police never found the bomber.
Jihadist gun and bomb attacks have killed more than 250 people in France since 2015 and the country remains on high alert, with military patrols a regular feature of security in cities including Lyon.
The blast in Lyon comes days before France votes in the European elections after a closely fought race.