Twenty-two children were among the wounded in the daytime attack on President Volodymyr Zelenskiy's hometown, regional governor Oleksandr Hanzha said on the Telegram messaging app.
"There are 29 people in serious condition, including five children," he said.
He posted a photo of black smoke billowing from a large industrial building.
Zelenskiy called the attack "absolutely cynical and despicable," saying that a second Russian drone hit the shopping centre half an hour after the first in a deliberate attempt to target emergency services.
"Attacks like these are nothing less than terrorist acts," Zelenskiy said in a social media post, urging the world to hold Russia to account.
Russia is escalating its air war on Ukraine as fighting on the battlefield grinds toward the four-and-a-half-year mark.
On Thursday, 17 people were killed in a Russian ballistic missile attack on the Ukrainian capital Kyiv.
Ukraine has also stepped up its own attacks on Russia, targeting oil facilities and logistics infrastructure in what it calls a bid to undermine the Russian ability to wage war.
A Ukrainian drone attack killed one person and wounded four others when a car was struck on Friday in Russia's Belgorod region near the village of Razumnoye, local officials said, adding that two of the injured were in serious condition.
Zelenskiy said a Ukrainian drone attack hit an oil refinery in Perm, more than 1600km from his country's border.
Also struck was the Marinovka military airfield in the Volgograd region of Russia, he said.
The Russian online news outlet Astra reported that the Ukrainian drone had set ablaze a Lukoil-operated oil refinery in Perm.
Local officials said damage was recorded at an unidentified "industrial facility".
Russia's Defence Ministry said its air defences overnight intercepted 325 Ukrainian drones over 15 Russian regions as well as Crimea.
with AP
13°C