The gunman was shot dead by the police soon after he fired at the people who had gathered at the annual garlic festival in Gilroy, northern California, on Sunday.
Police chief Scott Smithee told reporters that the attack took place around 5.41 p.m. (local time) when the festival was about to end for the weekend, the US media reported.
Smithee said officers engaged the shooter "in less than a minute".
There was "a white man in his early to mid-30s firing a rifle", eyewitness Julissa Contreras told NBC.
Smithee said: "It is believed that the shooter cut through the fence to gain access to the festival" and opened fire indiscriminately.
Citing witnesses, the police chief said a second suspect may have been involved, possibly in a support role. But no details were known about the second suspect.
Videos posted on social media showed people running away from the festival, which took place 48 kilometre south of San Jose.
"What's going on?" a woman can be heard asking in one video, "who'd shoot up a garlic festival?"
"We couldn't feel worse," the festival's Executive Director Brian Bowe said at a press conference. "It's just a horrible thing to experience."
"This is nothing short of horrific," tweeted California Governor Gavin Newsom.
US President Donald Trump also tweeted about the shooting, urging people to "be careful and safe".
Michael Paz, 72, a hat vendor at the festival, told the San Francisco Chronicle that he saw a gunman armed with a rapid-fire assault rifle.
"He came ready to shoot because he was wearing a protective vest. He was shooting left; he was shooting right without any particular aim," he said.
As the police swooped on the gunman and shots were fired, festival attendees dropped to the ground, Paz added.
Gilroy is predominantly a rural society of some 50,000 residents, located 130 km south of San Francisco.
Gilroy is the leading producer of garlic in the country and a festival dedicated to it is held every summer, where those attending can enjoy all sorts of dishes prepared with this condiment.
( With inputs from IANS )