Police blamed the attack on terrorists.
Kenyan military and police surrounded the mall, which had been hosting a children's day event, and helicopters flew overhead. Gunmen remained inside hours after the attack, although firing subsided.
There was no immediate claim of responsibility for the attack, but an off duty military official identified one of the attackers as Somali.
People continued to trickle out from hiding places within the mall, which is frequented by expatriates and rich Kenyans in Nairobi's affluent Westlands neighborhood. It was not immediately known how many people remained inside, and whether they were still alive.
Earlier in the day mall guards used shopping carts to wheel out wounded children, as others emerged crying or clutching their kids.
The death toll is expected to rise, said Kenya Red Cross official Abbas Gullet.
"We are treating this as a terrorist attack," said police chief Benson Kibue, adding that there are likely no more than 10 attackers involved. Police did not say what group was responsible for the attack.
Somali's Islamic extremist rebels, al-Shabab, vowed in late 2011 to carry out a large-scale attack in Nairobi in retaliation for Kenya sending troops into Somalia to fight the insurgents.
Off duty Sgt. Major Frank Mugungu said Saturday he saw four male attackers and one female, and that he could clearly identify one of the gunmen as a Somali, though he could not identify the rest.
The Westgate mall, with shops like Nike, adidas and Bose, has Israeli ownership, and security experts have in the past identified the mall as a possible terror target in Nairobi.
The gunmen announced that non-Muslims would be targeted, said Elijah Kamau, who was at the mall at the time of the midday attack.
"The gunmen told Muslims to stand up and leave. They were safe, and non-Muslims would be targeted," he said.
Jay Patel, who sought cover on an upper floor in the mall when shooting began, said that when he looked out of a window onto the upper parking deck of the mall he saw the gunmen with a group of people.
Patel said that as the attackers were talking, some of the people stood up and left and the others were shot.
The gunmen carried AK-47s and wore vests with hand grenades on them, said Manish Turohit, 18, who hid in a parking garage for two hours.
"They just came in and threw a grenade. We were running and they opened fire. They were shouting and firing," he said after marching out of the mall in a line of 15 people who all held their hands in the air, in an apparent attempt to not be shot.
Rob Vandijk, who works at the Dutch embassy, said he was eating at a restaurant inside the mall when attackers lobbed hand grenades inside the building. He said gunfire then burst out and people screamed as they dropped to the ground.
It appears the attack began at the outdoor seating area of Artcaffe at the front of the mall, witnesses said.
Patrick Kuria, an employee at Artcaffe, said: "We started by hearing gunshots downstairs and outside. Later we heard them come inside. We took cover. Then we saw two gunmen wearing black turbans. I saw them shoot."
Some people were shot at the entrance to the mall after volleys of gunfire moved outside and a standoff with police began. Ambulances continued to stream in and out of the mall area, ferrying the wounded who gradually emerged from hiding inside the mall.
A local hospital was overwhelmed with the number of wounded being brought in hours after the attack, so they had to divert them to a second facility.
The United Nations secretary-general's office said that Ban Ki-moon has spoken with President Uhuru Kenyatta and expressed his concern. Meanwhile, Britain's Foreign Office urged British nationals to avoid the area, saying it is "urgently looking into" the incident and ready to provide consular assistance in case any British are involved.
Kenya suffered a spate of grenade attacks that killed more than 60 people from October 2011 to March 2013 after al-Shabab threatened attacks. Police attributed the attacks to sympathizers of al-Shabab in Kenya.
Authorities said they have thwarted other large-scale attacks targeting public spaces. Kenyan police said in September 2012 they disrupted a major terrorist attack in its final stages of planning, arresting two people with explosive devices and a cache of weapons and ammunition.
Anti-terror Police Unit boss Boniface Mwaniki said vests found were similar to those used in attacks that killed 76 people in Uganda who gathered to watch the soccer World Cup finals on TV in July 2010. Al-Shabab claimed responsibility for those bombings, saying the attack was in retaliation for Uganda's participation in the African Union's peacekeeping mission in Somalia.
In January 2012, Kenya said it had thwarted attempted attacks by al-Shabab over Christmas and the New Year.