Local media reported that a 30-year-old supermarket cashier died after a man started attacking people in Assago.
Among the injured was Pablo Marí, a football player on loan from Arsenal.
A 46-year-old suspect has been detained. Police have ruled out any terrorist motive.
Reports say the attacker has had mental health problems and had grabbed the weapon from the supermarket shelves.
The man started stabbing people at random at about 18:30 local time (16:30 GMT) at a Carrefour in a local shopping centre.
Screams were reportedly heard inside the centre, as terrified visitors tried to flee in panic.
The attacker is reported to have been detained by several customers and handed over to police who arrived at the scene.
Marí, a 29-year-old Spanish defender, suffered a stab wound to the back – but his injuries are not life-threatening. His agent, Arturo Canales, told the BBC that the star was conscious and no vital organs had been affected.
Monza CEO Adriano Galliani told Sky Italia that Marí had been shopping with his wife and young son when the attack took place.
“He had his son in a trolley and his wife next to him. He didn’t notice anything. He then felt something painful in his back, which was the criminal’s knife,” Mr Galliani said.
“Unfortunately, he also saw the criminal stab someone in the throat. He saw everything that happened and it was deeply disturbing,” Galliani added.
While the executive said the defender had suffered a “fairly deep wound on his back”, he said his life was not in danger and that he “should recover quickly”.
Marí joined Arsenal from Brazilian side Flamengo in January 2020. He has only played 19 times for the Gunners and is currently on loan with top flight Italian club Monza.
Arsenal manager Mikel Arteta said: “I just found out. I know Edu [Arsenal technical director] has been in touch with his relatives. He’s in hospital but he seems to be okay.”