The suspect also injured himself.
The 19-year-old was detained by police near the city's beach, not far from the school, according to prosecutors.
Regional governor Mariusz Frankowski said 10 people were injured in the incident, including the attacker. Nine of them were taken to hospitals, he told reporters.
The nine injured in the attack included five students, two teachers and two bystanders, according to Frankowski.
One of the injured was initially in serious condition, but prosecutors later said the person's injuries were not life-threatening.
Six people were hospitalised in Ostrołęka and two were taken to a hospital in nearby Łomża, according to regional broadcaster TVP3 Warszawa.
Two of those taken to the Ostrołęka hospital were later discharged, reporters were told.
The attacker, a student at the school and a resident of Ostrołęka, was taken to a hospital in the town of Ostrów Mazowiecka for treatment, state news agency PAP reported.
Frankowski said the attacker was a Polish citizen.
The fire service said some of those injured were hurt in a city park as the attacker fled.
The attack took place shortly after 11 a.m. at Vocational School Complex No. 4 in Ostrołęka, about 120 km northeast of Warsaw.
According to witness accounts cited by Polish media, the attacker entered the school and threw down a backpack from which smoke emerged before attacking students with a knife and fleeing.
Police confirmed that the suspect, described as a student or former student of the school, was detained near the city beach alone the Narew river.
Prosecutors said two prosecutors and a team of police officers were working at the scene.
Elżbieta Łukasiewicz, a spokeswoman for the Ostrołęka District Prosecutor's Office, told reporters that witnesses would be questioned as soon as their health permits, while surveillance footage would be secured if available.
Ostrołęka Mayor Paweł Niewiadomski said "the situation has been brought under control, and the perpetrator has been detained."
He ordered Vocational School Complex No. 4 closed and instructed other schools run by the city not to allow unauthorised individuals onto their premises.
He urged students, parents and school employees to remain calm and follow instructions from school authorities and emergency services.
Niewiadomski said psychological support would be provided to anyone affected by the incident, particularly students who experienced severe stress or felt threatened.
He also appealed to the public not to publish photos or recordings from the scene on social media or spread unverified information.
"The most important thing now is safety and providing the injured with the necessary assistance," he said.
A crisis management team was convened at City Hall in the early afternoon.
"Our thoughts today are primarily with those who were injured, their families, students, teachers and everyone affected by this traumatic event," Niewiadomski said in a statement, wishing the injured a speedy recovery and the school community "strength and peace."
Children's Rights Ombudswoman Monika Horna-Cieślak said her office was in contact with the education authorities and police and that she would monitor the proceedings.
"I do not and will not consent to violence against children," she wrote on social media.