If the ForwardX11 variable is set to “yes” (or see the description of the -X and -x options described later) and the user is using X11 (the DISPLAY environment variable is set), the connection to the
X11 display is automatically forwarded to the remote side in such a way that any X11 programs started from the shell (or command) will go through the encrypted channel, and the connection to the real X
server will be made from the local machine. The user should not manually set DISPLAY. Forwarding of X11 connections can be configured on the command line or in configuration files.
...
-X Enables X11 forwarding. This can also be specified on a per-host basis in a configuration file.

X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the user’s X authorization database) can access the local X11 display
through the forwarded connection. An attacker may then be able to perform activities such as keystroke monitoring.

-x Disables X11 forwarding.

-Y Enables trusted X11 forwarding.